CRITICAL

CVE-2018-17452

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

9.8

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

Summary dbcve.org

GitLab contains an SSRF vulnerability in the url_blocker.rb validation logic. The validate_localhost function improperly allows requests to loopback addresses (127.0.0.1/localhost), enabling attackers to make the server probe internal services that should be inaccessible from external networks.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1 or later to patch the vulnerable url_blocker.rb validation function.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.74%

Probability of exploitation in next 30 days

53th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE