HIGH

CVE-2018-17451

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

8.8

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.

Summary dbcve.org

Cross-Site Request Forgery vulnerability in GitLab's Slack integration for slash commands allows attackers to craft malicious requests that trick authenticated users into executing unintended slash commands via their GitLab session.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1 or later to obtain the CSRF fix for the Slack integration.

Weakness (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

EPSS Score

0.32%

Probability of exploitation in next 30 days

24.7th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE