HIGH

CVE-2018-17455

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

7.5

Description

An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.

Summary dbcve.org

An Insecure Direct Object Reference (IDOR) vulnerability in GitLab Enterprise Edition's merge request approvals feature allows unauthorized attackers to access sensitive group information including names, avatars, LDAP settings, and descriptions. This is a HIGH severity (CVSS 7.5) information disclosure issue affecting versions 11.1.x before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.

Mitigation

Upgrade GitLab Enterprise Edition to version 11.1.7, 11.2.4, 11.3.1 or later. Alternatively, if upgrading is not immediately feasible, review access controls on the merge request approvals API endpoints and implement additional authorization checks.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

0.62%

Probability of exploitation in next 30 days

48.4th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE