PT-2023-10696 · Gitlab · Gitlab Ce/Ee+1

Ngalog · Published 2023-04-15 · Updated 2023-04-25 · CVE-2018-17449

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.0 through 11.1.7 GitLab Community and Enterprise Edition versions 11.2.x through 11.2.4 GitLab Community and Enterprise Edition versions 11.3.x through 11.3.1

Description An issue allows remote attackers to obtain sensitive information about issues, comments, and project titles via the events API insecure direct object reference.

Recommendations For versions 11.1.0 through 11.1.7, update to version 11.1.7 or later. For versions 11.2.x through 11.2.4, update to version 11.2.4 or later. For versions 11.3.x through 11.3.1, update to version 11.3.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2018-17449

Affected Products

Gitlab

Gitlab Ce/Ee

References · 6

• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17449 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17449 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17449 · Note
• https://t.me/cvenotify/49072 · Telegram Post
• https://about.gitlab.com/blog/categories/releases · Note