CVE-2017-0915

CWE-77 — Command InjectionCWE-20 — Improper Input Validation5 documents5 sources
Severity
9.8CRITICAL
EPSS
1.2%
top 21.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gitlab GitlabGitlab Gitlab Community AND Enterprise EditionsDebian Debian Linux
Timeline
PublishedMar 21
Latest updateMay 13

Description

Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5gitlab/gitlab_community_and_enterprise_editions10.2.0 - 10.2.5 Fixed in 10.2.6, 10.3.0 - 10.3.3 Fixed in 10.3.4, 8.9 - 10.1.5 Fixed in 10.1.6+2
▶NVDgitlab/gitlab8.9.0 — 9.5.10+3

Also affects: Debian Linux 9.0

🔴Vulnerability Details

2
GHSA
GHSA-727w-x522-pvpc: Gitlab Community Edition version 10↗2022-05-13
▶
CVEList
CVE-2017-0915: Gitlab Community Edition version 10↗2018-03-21
▶

📋Vendor Advisories

2
GitLab
CVE-2017-0915: Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execut↗2018-03-21
▶
Debian
CVE-2017-0915: gitlab - Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validat...↗2017
▶
CVE-2017-0915 (CRITICAL CVSS 9.8) | Gitlab Community Edition version 10 | cvebase.io