CVE-2017-12426 — Improper Input Validation in Gitlab

CWE-20 — Improper Input Validation5 documents5 sources
Severity
8.8HIGHNVD
EPSS
1.1%
top 22.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian GitlabGitlab
Timeline
PublishedAug 14
Latest updateMay 17

Description

GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/gitlab< gitlab 9.5.4+dfsg-7 (sid)
▶NVDgitlab/gitlab8.17.7+47
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-mwvc-fhmm-47cq: GitLab Community Edition (CE) and Enterprise Edition (EE) before 8↗2022-05-17
▶
OSV
CVE-2017-12426: GitLab Community Edition (CE) and Enterprise Edition (EE) before 8↗2017-08-14
▶

📋Vendor Advisories

2
GitLab
CVE-2017-12426: GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9↗2017-08-14
▶
Debian
CVE-2017-12426: gitlab - GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x b...↗2017
▶