PT-2023-2596 · Gitlab · Gitlab Ce/Ee+1

Jobert · Published 2023-04-15 · Updated 2023-04-25 · CVE-2018-17455

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 11.1.7 and earlier, 11.2.x before 11.2.4, 11.3.x before 11.3.1

Description An issue was discovered related to the "merge request approvals" feature, where attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 11.1.7 and earlier, update to version 11.1.7 or later. For versions 11.2.x before 11.2.4, update to version 11.2.4 or later. For versions 11.3.x before 11.3.1, update to version 11.3.1 or later. As a temporary workaround, consider restricting access to the "merge request approvals" feature until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

BDU:2023-02425

CVE-2018-17455

Affected Products

Gitlab

Gitlab Ce/Ee

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-17455 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17455 · Vendor Advisory
• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02425 · Security Note
• https://about.gitlab.com/blog/categories/releases · Note
• https://vuldb.com/ru/?id.226129 · Note
• https://t.me/cvenotify/48350 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17455 · Note