CVE-2018-3710: Path Traversal
Published Mar 21, 2018
·Updated
Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.
Affected Software
10 affected componentsFixes available
debian/gitlab
16.0.8+ds1-2
GitLab GitLab>=8.9.0<=9.5.10
GitLab GitLab>=8.9.0<=9.5.10
GitLab GitLab>=10.0.0<=10.1.5
GitLab GitLab>=10.0.0<=10.1.15
GitLab GitLab>10.2.0<=10.2.5
GitLab GitLab>=10.2.0<=10.2.5
GitLab GitLab>10.3.0<=10.3.3
GitLab GitLab>=10.3.0<=10.3.3
Debian Debian Linux=9.0
Event History
Mar 21, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-3710?
CVE-2018-3710 has a high severity rating due to its potential to allow remote code execution.
2
How do I fix CVE-2018-3710?
To fix CVE-2018-3710, upgrade GitLab to version 10.3.4 or later.
3
Which versions of GitLab are affected by CVE-2018-3710?
CVE-2018-3710 affects GitLab Community and Enterprise Editions from version 8.9.0 to 10.3.3.
4
What is the impact of CVE-2018-3710?
The impact of CVE-2018-3710 includes the risk of remote code execution due to insecure temporary file handling.
5
Is CVE-2018-3710 present in any Debian packages?
Yes, CVE-2018-3710 is present in GitLab packages on Debian systems prior to the patched version.