HIGH

CVE-2017-0922

Gitlab GitLab 2018-03-21 CVSS v3.0

CVSS

7.5

Description

Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.

Summary dbcve.org

GitLab Enterprise Edition 10.3 contains an authorization bypass vulnerability in the Projects::BoardsController component that allows unauthorized users to access board objects they should not have permission to view, resulting in information disclosure.

Mitigation

Upgrade to a patched GitLab version or implement proper authorization checks in the BoardsController to validate user permissions before returning board object data.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

CWE-863 Incorrect Authorization

EPSS Score

1.33%

Probability of exploitation in next 30 days

69.8th percentile

References

https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/ Vendor Advisory https://hackerone.com/reports/301123 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE