CVE-2017-0920
22.03.2018, 15:29
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 8.8.0 < 𝑥 ≤ 10.1.5 |
| gitlab | gitlab | 8.8.0 ≤ 𝑥 ≤ 10.1.5 |
| gitlab | gitlab | 10.2.0 < 𝑥 ≤ 10.2.5 |
| gitlab | gitlab | 10.2.0 ≤ 𝑥 ≤ 10.2.5 |
| gitlab | gitlab | 10.3.0 < 𝑥 ≤ 10.3.3 |
| gitlab | gitlab | 10.3.0 ≤ 𝑥 ≤ 10.3.3 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References