CVE-2018-14603: CSRF
Published Jul 27, 2018
·Updated
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test feature of the System Hooks component.
Affected Software
6 affected components
GitLab GitLab<10.8.7
GitLab GitLab<10.8.7
GitLab GitLab>=11.0.0<11.0.5
GitLab GitLab>=11.0.0<11.0.5
GitLab GitLab>=11.1.0<11.1.2
GitLab GitLab>=11.1.0<11.1.2
Event History
Jul 27, 2018
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-14603?
CVE-2018-14603 has a medium severity rating due to the potential for CSRF attacks in GitLab.
2
How do I fix CVE-2018-14603?
To fix CVE-2018-14603, update GitLab to version 10.8.7, 11.0.5, or 11.1.2 or later.
3
What components are affected by CVE-2018-14603?
CVE-2018-14603 affects the System Hooks component in GitLab's Test feature.
4
In which versions of GitLab is CVE-2018-14603 present?
CVE-2018-14603 is present in GitLab versions prior to 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2.
5
What types of GitLab editions are affected by CVE-2018-14603?
Both the Community and Enterprise Editions of GitLab are affected by CVE-2018-14603.