CVE-2017-0922
21.03.2018, 20:29
Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 9.1.0 ≤ 𝑥 ≤ 9.5.10 |
| gitlab | gitlab | 9.1.0 ≤ 𝑥 ≤ 9.5.10 |
| gitlab | gitlab | 10.0.0 ≤ 𝑥 ≤ 10.1.5 |
| gitlab | gitlab | 10.0.0 ≤ 𝑥 ≤ 10.1.5 |
| gitlab | gitlab | 10.2.0 ≤ 𝑥 ≤ 10.2.5 |
| gitlab | gitlab | 10.2.0 ≤ 𝑥 ≤ 10.2.5 |
| gitlab | gitlab | 10.3.0 ≤ 𝑥 ≤ 10.3.3 |
| gitlab | gitlab | 10.3.0 ≤ 𝑥 ≤ 10.3.3 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.