Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-4340 — Gitlab vulnerability

CWE-2646 documents6 sources
Severity
8.8HIGHNVD
EPSS
2.5%
top 14.70%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Debian GitlabGitlab
Timeline
PublishedJan 23
Latest updateMay 17

Description

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/gitlab< gitlab 8.8.2+dfsg-1 (sid)
▶NVDgitlab/gitlab45 versions+44
▶gitlabgitlab/gitlab

Patches

Patch: about.gitlab.com ↗Patch: gitlab.com ↗Patch: about.gitlab.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rxh8-jh3g-ccqq: The impersonate feature in Gitlab 8↗2022-05-17
▶
OSV
CVE-2016-4340: The impersonate feature in Gitlab 8↗2017-01-23
▶

💥Exploits & PoCs

1
Exploit-DB
GitLab - 'impersonate' Feature Privilege Escalation↗2016-08-15
▶

📋Vendor Advisories

2
GitLab
CVE-2016-4340: The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4↗2017-01-23
▶
Debian
CVE-2016-4340: gitlab - The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5....↗2016
▶