CVEvulnerability

CVE-2017-0919

7.5 HIGH Published 2018-07-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-306

Description

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.

Affected configurations

• gitlab gitlab (< 10.1.6) • gitlab gitlab (>= 10.2.0 < 10.2.6) • gitlab gitlab (>= 10.3.0 < 10.3.4)

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References