PT-2018-14688 · Gitlab · Gitlab Ce/Ee+1

Mayra Cabrera · Published 2018-12-04 · Updated 2019-02-05 · CVE-2018-18843

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 11.0.0 through 11.2.7 GitLab Enterprise Edition versions 11.3.0 through 11.3.8 GitLab Enterprise Edition versions 11.4.0 through 11.4.3

Description The issue affects the Kubernetes integration in GitLab Enterprise Edition, allowing for Server-Side Request Forgery (SSRF).

Recommendations For GitLab Enterprise Edition versions 11.0.0 through 11.2.7, update to version 11.2.8 or later. For GitLab Enterprise Edition versions 11.3.0 through 11.3.8, update to version 11.3.9 or later. For GitLab Enterprise Edition versions 11.4.0 through 11.4.3, update to version 11.4.4 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2018-18843

Affected Products

Gitlab

Gitlab Ce/Ee

References · 6

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/53158 · Exploit
• https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18843 · Security Note
• https://about.gitlab.com/releases/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18843 · Note