CVE-2018-17452 — Server-Side Request Forgery in Gitlab

CWE-918 — Server-Side Request Forgery5 documents5 sources

Severity

9.8CRITICALNVD

EPSS

0.3%

top 49.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedApr 15

Latest updateApr 16

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDgitlab/gitlab11.2.0 — 11.2.4+2

▶debiandebian/gitlab< gitlab 11.1.8+dfsg-2 (sid)

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-8xwc-6h6p-hh69: An issue was discovered in GitLab Community and Enterprise Edition before 11↗2023-04-16

▶

OSV

CVE-2018-17452: An issue was discovered in GitLab Community and Enterprise Edition before 11↗2023-04-15

▶

📋Vendor Advisories

GitLab

CVE-2018-17452: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side↗2023-04-15

▶

Debian

CVE-2018-17452: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7...↗2018

▶