CVE-2018-17450: SSRF
Published Apr 15, 2023
·Updated
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.
Affected Software
6 affected components
GitLab GitLab<11.1.7
GitLab GitLab<11.1.7
GitLab GitLab>=11.2.0<11.2.4
GitLab GitLab>=11.2.0<11.2.4
GitLab GitLab=11.3.0
GitLab GitLab=11.3.0
Event History
Apr 15, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-17450?
CVE-2018-17450 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2018-17450?
To fix CVE-2018-17450, upgrade GitLab to version 11.1.7, 11.2.4, or 11.3.1 or later.
3
What type of vulnerability is CVE-2018-17450?
CVE-2018-17450 is identified as a Server-Side Request Forgery (SSRF) vulnerability.
4
What can be compromised due to CVE-2018-17450?
Due to CVE-2018-17450, there is potential disclosure of a Google Cloud Platform (GCP) service token.
5
Which versions of GitLab are affected by CVE-2018-17450?
GitLab Community and Enterprise Editions before 11.1.7, between 11.2.0 and 11.2.4, and 11.3.0 are affected by CVE-2018-17450.