CVE-2017-0916

CWE-77 — Command InjectionCWE-20 — Improper Input Validation5 documents5 sources
Severity
9.8CRITICAL
EPSS
0.4%
top 37.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gitlab GitlabGitlab Gitlab Community AND Enterprise EditionsDebian Debian Linux
Timeline
PublishedMar 21
Latest updateMay 13

Description

Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5gitlab/gitlab_community_and_enterprise_editions10.2.0 - 10.2.5 Fixed in 10.2.6, 10.3.0 - 10.3.3 Fixed in 10.3.4, 9.1.0 - 10.1.5 Fixed in 10.1.6+2
▶NVDgitlab/gitlab8.8.0 — 10.1.5+2

Also affects: Debian Linux 9.0

🔴Vulnerability Details

2
GHSA
GHSA-47xx-c7pc-hm29: Gitlab Community Edition version 10↗2022-05-13
▶
CVEList
CVE-2017-0916: Gitlab Community Edition version 10↗2018-03-21
▶

📋Vendor Advisories

2
GitLab
CVE-2017-0916: Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting i↗2018-03-21
▶
Debian
CVE-2017-0916: gitlab - Gitlab Community Edition version 10.3 is vulnerable to a lack of input validatio...↗2017
▶
CVE-2017-0916 (CRITICAL CVSS 9.8) | Gitlab Community Edition version 10 | cvebase.io