CVE-2018-14364 — Path Traversal in Gitlab

CWE-22 — Path Traversal4 documents4 sources

Severity

9.8CRITICALNVD

EPSS

39.7%

top 2.68%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedJul 18

Latest updateMay 14

Description

GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDgitlab/gitlab10.8.0 — 10.8.6+2

▶debiandebian/gitlab< gitlab 10.7.7+dfsg-2 (sid)

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-wmcm-x8vj-qqp7: GitLab Community and Enterprise Edition before 10↗2022-05-14

▶

📋Vendor Advisories

GitLab

CVE-2018-14364: GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and r↗2018-07-18

▶

Debian

CVE-2018-14364: gitlab - GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and...↗2018

▶