CVE-2017-0919

published 2018-07-03

CVE-2017-0919: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component…

Priority P3 36 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I H A N

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 10.5.5+dfsg-1 (sid)	gitlab 10.5.5+dfsg-1 (sid)
gitlab	gitlab	< 10.1.6	10.1.6
gitlab	gitlab	—	—
gitlab	gitlab	>= 10.2.0 < 10.2.6	10.2.6
gitlab	gitlab	>= 10.3.0 < 10.3.4	10.3.4

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

osv 7.5 HIGH

vendor_debian 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306