CVE-2018-18646: SSRF
Published Dec 4, 2018
·Updated
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.
Affected Software
6 affected components
GitLab GitLab>=5.3<11.2.7
GitLab GitLab>=5.3<11.2.7
GitLab GitLab>=11.3.0<11.3.8
GitLab GitLab>=11.3.0<11.3.8
GitLab GitLab>=11.4.0<11.4.3
GitLab GitLab>=11.4.0<11.4.3
Event History
Dec 4, 2018
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-18646?
CVE-2018-18646 is considered a high severity vulnerability due to its potential for SSRF attacks.
2
How do I fix CVE-2018-18646?
To fix CVE-2018-18646, you should upgrade GitLab to version 11.2.7, 11.3.8, or 11.4.3, or later.
3
What types of GitLab installations are affected by CVE-2018-18646?
CVE-2018-18646 affects both the GitLab Community and Enterprise Editions before the specified patched versions.
4
Can CVE-2018-18646 lead to data breaches?
Yes, CVE-2018-18646 can lead to unauthorized access to local services and may potentially result in data breaches.
5
What is SSRF in the context of CVE-2018-18646?
SSRF, or Server-Side Request Forgery, is a vulnerability that allows an attacker to induce a server-side application to make requests to an unintended location.