| Vulnerability Name: | CVE-2017-0882 (CCN-130424) |
| Assigned: | 2016-11-30 |
| Published: | 2017-03-20 |
| Updated: | 2019-10-09 |
| Summary: | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.
|
| CVSS v3 Severity: | 6.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
5.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low |
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): None
Availibility (A): None |
|
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None |
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None |
|
| Vulnerability Type: | CWE-200
|
| Vulnerability Consequences: | Obtain Information |
| References: | Source: MITRE
Type: CNA
CVE-2017-0882
Source: BID
Type: Third Party Advisory, VDB Entry
97157
Source: CCN
Type: BID-97157
GitLab CVE-2017-0882 Information Disclosure Vulnerability
Source: CCN
Type: GitLab Web site
GitLab 8.17.4, 8.16.8, and 8.15.8 Released
Source: MISC
Type: Release Notes, Vendor Advisory
https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/
Source: XF
Type: UNKNOWN
gitlab-cve20170882-info-disc(130424)
Source: MISC
Type: Patch, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1
Source: MISC
Type: Patch, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b
Source: MISC
Type: Patch, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5
Source: MISC
Type: Exploit, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/29661
Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-0882
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:gitlab:gitlab:8.2.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.2.1:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.2.2:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.2.3:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.2.4:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.2.5:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.3.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.3.8:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.3.9:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.4.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.4.9:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.4.10:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.5.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.5.11:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.5.12:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.6.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.6.7:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.6.8:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.7.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.7.1:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.10.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.10.12:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.10.13:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.11.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.11.9:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.11.10:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.12.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.12.7:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.12.8:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.13.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.13.2:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.13.3:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.1:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.2:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.3:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.4:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.5:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.14.6:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.1:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.2:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.3:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.4:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.5:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.6:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.15.7:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.1:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.2:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.3:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.4:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.5:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.6:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.7:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.17.0:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.17.1:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.17.2:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.17.3:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/a:gitlab:gitlab:8.15.7:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.16.6:*:*:*:*:*:*:*OR cpe:/a:gitlab:gitlab:8.17.3:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |