CVE-2017-0925: High severity gitlab vulnerability
Published Mar 21, 2018
·Updated
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.
Affected Software
10 affected componentsFixes available
debian/gitlab
16.0.8+ds1-2
GitLab GitLab>=8.0.0<=9.5.10
GitLab GitLab>=8.0.0<=9.5.10
GitLab GitLab>=10.0.0<=10.1.5
GitLab GitLab>=10.0.0<=10.1.5
GitLab GitLab>=10.2.0<=10.2.5
GitLab GitLab>=10.2.0<=10.2.5
GitLab GitLab>=10.3.0<=10.3.3
GitLab GitLab>=10.3.0<=10.3.3
Debian Debian Linux=9.0
Event History
Mar 21, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-0925?
CVE-2017-0925 is classified as a medium severity vulnerability due to its potential for information disclosure of plaintext passwords.
2
How do I fix CVE-2017-0925?
To remediate CVE-2017-0925, upgrade GitLab to version 10.1.6 or later.
3
Which versions of GitLab are affected by CVE-2017-0925?
CVE-2017-0925 affects GitLab Community and Enterprise Editions from version 8.0.0 to 10.1.5.
4
What kind of issue does CVE-2017-0925 represent?
CVE-2017-0925 represents an insufficiently protected credential issue in the project service integration API endpoint.
5
What impact does CVE-2017-0925 have on users?
The impact of CVE-2017-0925 on users is the potential exposure of sensitive information, specifically plaintext passwords.