CVE-2017-0925
21.03.2018, 20:29
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 8.0.0 ≤ 𝑥 ≤ 9.5.10 |
| gitlab | gitlab | 8.0.0 ≤ 𝑥 ≤ 9.5.10 |
| gitlab | gitlab | 10.0.0 ≤ 𝑥 ≤ 10.1.5 |
| gitlab | gitlab | 10.0.0 ≤ 𝑥 ≤ 10.1.5 |
| gitlab | gitlab | 10.2.0 ≤ 𝑥 ≤ 10.2.5 |
| gitlab | gitlab | 10.2.0 ≤ 𝑥 ≤ 10.2.5 |
| gitlab | gitlab | 10.3.0 ≤ 𝑥 ≤ 10.3.3 |
| gitlab | gitlab | 10.3.0 ≤ 𝑥 ≤ 10.3.3 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-319 - Cleartext Transmission of Sensitive InformationThe software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
References