HIGH

CVE-2018-17449

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

7.5

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.

Summary dbcve.org

GitLab versions before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 contain an Insecure Direct Object Reference (IDOR) vulnerability in the events API. Remote attackers can access sensitive information including issues, comments, and project titles by manipulating object references in API requests, bypassing intended access controls.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1 or later. Verify that the events API now properly enforces authorization checks before returning sensitive project data.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

0.84%

Probability of exploitation in next 30 days

56.3th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE