CVE-2018-17455

7.5

HIGHCVSS v3

Published

April 15, 2023

Affected

9 projects

Assigned by

MITRE

Severity scale

010

Description

An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.

gitlab

NPMFull NodeJS implementation of the GitLab API. Supports Promises, Async/Await.

>= 11.2.0, < 11.2.4, < 11.1.7, = 11.3.0NVD

@semantic-release/gitlab

NPMsemantic-release plugin to publish a GitLab release

>= 11.2.0, < 11.2.4, < 11.1.7, = 11.3.0NVD

semantic-release/gitlab

GitHub

More on this CVE

NVD↗GitHub Advisory↗

:fox_face: semantic-release plugin to publish a GitLab release

>= 11.2.0, < 11.2.4, < 11.1.7, = 11.3.0NVD

gitlab-org/gitlab

GitLabGitLab is the open-source DevSecOps platform that provides a complete software development lifecycle toolchain including source control, CI/CD, security scanning, and project management in a single application.

>= 11.2.0, < 11.2.4, < 11.1.7, = 11.3.0NVD