Insecure Temporary File Vulnerability in GitLab Community and Enterprise Editions
CVE-2018-3710

7.8HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab Community And Enterprise Editions
Vendor
CVE Published:
21 March 2018

What is CVE-2018-3710?

GitLab Community and Enterprise Editions, specifically version 10.3.3, are susceptible to a vulnerability where insecure temporary files in the project import functionality may lead to remote code execution. This flaw may allow an attacker to execute arbitrary commands on the server when specific conditions are met. Proper validation and secure handling of temporary files are vital to mitigate the risk associated with this vulnerability.

Affected Version(s)

GitLab Community and Enterprise Editions 8.9 - 10.1.5 Fixed in 10.1.6

GitLab Community and Enterprise Editions 10.2.0 - 10.2.5 Fixed in 10.2.6

GitLab Community and Enterprise Editions 10.3.0 - 10.3.3 Fixed in 10.3.4

References

https://gitlab.com/gitlab-com/infrastructure/issues/3510
x_refsource_MISC
https://www.debian.org/security/2018/dsa-4145
vendor-advisoryx_refsource_DEBIAN
https://hackerone.com/reports/302959
x_refsource_MISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.