CVE-2017-0921 — Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CWE-640 — Weak Password Recovery Mechanism for Forgotten Password5 documents5 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 74.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedJul 3
Latest updateMay 14

Description

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶NVDgitlab/gitlab10.2.0 — 10.2.6+2
▶debiandebian/gitlab< gitlab 10.7.7+dfsg-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-r86w-x85m-w6rj: GitLab Community and Enterprise Editions before 10↗2022-05-14
▶
OSV
CVE-2017-0921: GitLab Community and Enterprise Editions before 10↗2018-07-03
▶

📋Vendor Advisories

2
GitLab
CVE-2017-0921: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsContr↗2018-07-03
▶
Debian
CVE-2017-0921: gitlab - GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are v...↗2017
▶