Insecure Temporary File Vulnerability in GitLab Community and Enterprise Editions
CVE-2018-3710

7.8HIGH

Key Information:

Vendor
Gitlab
Status
Gitlab Community And Enterprise Editions
Vendor
CVE Published:
21 March 2018

Summary

GitLab Community and Enterprise Editions, specifically version 10.3.3, are susceptible to a vulnerability where insecure temporary files in the project import functionality may lead to remote code execution. This flaw may allow an attacker to execute arbitrary commands on the server when specific conditions are met. Proper validation and secure handling of temporary files are vital to mitigate the risk associated with this vulnerability.

Affected Version(s)

GitLab Community and Enterprise Editions 8.9 - 10.1.5 Fixed in 10.1.6

GitLab Community and Enterprise Editions 10.2.0 - 10.2.5 Fixed in 10.2.6

GitLab Community and Enterprise Editions 10.3.0 - 10.3.3 Fixed in 10.3.4

References

https://gitlab.com/gitlab-com/infrastructure/issues/3510
x_refsource_MISC
https://www.debian.org/security/2018/dsa-4145
vendor-advisoryx_refsource_DEBIAN
https://hackerone.com/reports/302959
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
🍪 This website uses cookies, like every other website on the internet 😕 By using our website, you consent to the use of cookies.