CVE-2017-0927
Vulnerability from cvelistv5
Published
2018-03-21 20:00
Modified
2024-08-05 13:25
Severity
Summary
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.
References
Source | URL | Tags |
---|---|---|
support@hackerone.com | https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/ | Vendor Advisory |
support@hackerone.com | https://gitlab.com/gitlab-org/gitlab-ce/issues/37594 | Issue Tracking, Third Party Advisory |
Impacted products
Vendor | Product |
---|---|
GitLab | GitLab Community and Enterprise Editions |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T13:25:16.907Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/37594" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "GitLab Community and Enterprise Editions", "vendor": "GitLab", "versions": [ { "status": "affected", "version": "8.10.6 - 10.1.5 Fixed in 10.1.6" }, { "status": "affected", "version": "10.2.0 - 10.2.5 Fixed in 10.2.6" }, { "status": "affected", "version": "10.3.0 - 10.3.3 Fixed in 10.3.4" } ] } ], "datePublic": "2018-01-16T00:00:00", "descriptions": [ { "lang": "en", "value": "Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-285", "description": "Improper Authorization (CWE-285)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2018-03-21T19:57:01", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/37594" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2017-0927", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "GitLab Community and Enterprise Editions", "version": { "version_data": [ { "version_value": "8.10.6 - 10.1.5 Fixed in 10.1.6" }, { "version_value": "10.2.0 - 10.2.5 Fixed in 10.2.6" }, { "version_value": "10.3.0 - 10.3.3 Fixed in 10.3.4" } ] } } ] }, "vendor_name": "GitLab" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Improper Authorization (CWE-285)" } ] } ] }, "references": { "reference_data": [ { "name": "https://gitlab.com/gitlab-org/gitlab-ce/issues/37594", "refsource": "CONFIRM", "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/37594" }, { "name": "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource": "CONFIRM", "url": "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/" } ] } } } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2017-0927", "datePublished": "2018-03-21T20:00:00", "dateReserved": "2016-11-30T00:00:00", "dateUpdated": "2024-08-05T13:25:16.907Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2017-0927\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2018-03-21T20:29:00.857\",\"lastModified\":\"2019-10-09T23:21:13.557\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.\"},{\"lang\":\"es\",\"value\":\"Gitlab Community Edition 10.3 es vulnerable a un problema de autorizaci\u00f3n incorrecta en el componente deployment keys que resulta en el uso no autorizado de claves de implementaci\u00f3n por parte de usuarios invitados.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]},{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"8.16.0\",\"versionEndIncluding\":\"9.5.10\",\"matchCriteriaId\":\"8895687A-8E7F-41BF-9219-C0B7A1E30DD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"8.16.0\",\"versionEndIncluding\":\"9.5.10\",\"matchCriteriaId\":\"CC959153-DA6C-452B-B06B-8C925CEFEE71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndIncluding\":\"10.1.5\",\"matchCriteriaId\":\"81E7F704-BE11-4C38-A69B-27D22298703D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndIncluding\":\"10.1.5\",\"matchCriteriaId\":\"64162AE5-7888-44B6-9E40-F8003806408C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"10.2.0\",\"versionEndIncluding\":\"10.2.5\",\"matchCriteriaId\":\"643E78E8-2909-41D4-BC2A-2CADDA141DCB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"10.2.0\",\"versionEndIncluding\":\"10.2.5\",\"matchCriteriaId\":\"AA884C1E-9F66-41DA-9F23-1231086A75CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"10.3.0\",\"versionEndIncluding\":\"10.3.3\",\"matchCriteriaId\":\"7E7D952B-AB31-4962-B178-53260246B33E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"10.3.0\",\"versionEndIncluding\":\"10.3.3\",\"matchCriteriaId\":\"3CEEA359-A827-43C5-8489-FD49AE744CC4\"}]}]}],\"references\":[{\"url\":\"https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://gitlab.com/gitlab-org/gitlab-ce/issues/37594\",\"source\":\"support@hackerone.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]}]}}" } }
Loading...