CVE-2017-0919 — Missing Authentication for Critical Function in Gitlab

CWE-306 — Missing Authentication for Critical Function5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 78.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedJul 3
Latest updateMay 14

Description

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDgitlab/gitlab10.2.0 — 10.2.6+2
▶debiandebian/gitlab< gitlab 10.5.5+dfsg-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-q9g2-gp7g-r5fj: GitLab Community and Enterprise Editions before 10↗2022-05-14
▶
OSV
CVE-2017-0919: GitLab Community and Enterprise Editions before 10↗2018-07-03
▶

📋Vendor Advisories

2
GitLab
CVE-2017-0919: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import compon↗2018-07-03
▶
Debian
CVE-2017-0919: gitlab - GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are v...↗2017
▶