PT-2018-5153 · Gitlab · Gitlab Ce/Ee+1

Published 2018-03-18 · Updated 2019-10-09 · CVE-2017-0926

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3

Description The issue is related to an improper authorization problem in the Oauth sign-in component, which can result in unauthorized user login. This allows unauthorized access to the system.

Recommendations For Gitlab Community Edition version 10.3, consider disabling the Oauth sign-in component until a patch is available to prevent unauthorized user login. Restrict access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2017-0926

DSA-4145-1

Affected Products

Gitlab

Gitlab Ce/Ee

References · 18

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/32198 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0926 · Security Note
• https://security-tracker.debian.org/tracker/source-package/gitlab · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0915 · Security Note
• https://security-tracker.debian.org/tracker/DSA-4145-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4145-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4145 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0926 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0926 · Vendor Advisory
• https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0925 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0917 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3710 · Security Note