CVE-2018-17455: High severity gitlab vulnerability
An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-17455?
CVE-2018-17455 is a vulnerability in GitLab that allows attackers to access sensitive information through insecure direct object references.
What versions of GitLab are affected by CVE-2018-17455?
CVE-2018-17455 affects GitLab Enterprise Edition before 11.1.7, and GitLab Community Edition and Enterprise Edition between versions 11.2.0 and 11.2.4, as well as 11.3.0.
What is the potential impact of CVE-2018-17455?
The potential impact of CVE-2018-17455 includes unauthorized access to sensitive information such as group names, avatars, LDAP settings, and descriptions.
How do I fix CVE-2018-17455?
To fix CVE-2018-17455, upgrade to GitLab versions 11.1.7, 11.2.4, or 11.3.1 or later.
Is CVE-2018-17455 a critical vulnerability?
CVE-2018-17455 is classified as a medium-severity vulnerability due to the risk of information disclosure.