CVE-2017-11438

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-11438

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11438.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-11438

Published

2017-08-02T19:29:00.837Z

Modified

2026-08-24T06:13:38.485644Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

[none]

Details

GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.

References

https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

f33774cb120324d428dabf52c89b8a65e4d4c166

Last affected

61fee1520adef668450ae7315423542065d05028

Database specific

Show details

{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:gitlab:gitlab:9.0.0:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.0:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.1:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.2:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.2:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.3:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.3:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.4:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.4:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.5:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.5:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.6:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.6:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.7:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.7:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.8:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.8:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.9:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.9:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.10:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.0.10:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.0:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.0:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.1:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.2:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.2:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.3:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.3:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.4:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.4:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.5:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.5:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.6:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.6:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.7:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.1.7:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.0:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.0:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.1:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.2:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.2:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.3:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.3:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.4:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.4:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.5:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.5:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.6:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.6:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.7:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:9.2.7:*:*:*:enterprise:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "last_affected": "9.0.0"
        },
        {
            "introduced": "9.0.1"
        },
        {
            "last_affected": "9.0.1"
        },
        {
            "introduced": "9.0.2"
        },
        {
            "last_affected": "9.0.2"
        },
        {
            "introduced": "9.0.3"
        },
        {
            "last_affected": "9.0.3"
        },
        {
            "introduced": "9.0.4"
        },
        {
            "last_affected": "9.0.4"
        },
        {
            "introduced": "9.0.5"
        },
        {
            "last_affected": "9.0.5"
        },
        {
            "introduced": "9.0.6"
        },
        {
            "last_affected": "9.0.6"
        },
        {
            "introduced": "9.0.7"
        },
        {
            "last_affected": "9.0.7"
        },
        {
            "introduced": "9.0.8"
        },
        {
            "last_affected": "9.0.8"
        },
        {
            "introduced": "9.0.9"
        },
        {
            "last_affected": "9.0.9"
        },
        {
            "introduced": "9.0.10"
        },
        {
            "last_affected": "9.0.10"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "last_affected": "9.1.0"
        },
        {
            "introduced": "9.1.1"
        },
        {
            "last_affected": "9.1.1"
        },
        {
            "introduced": "9.1.2"
        },
        {
            "last_affected": "9.1.2"
        },
        {
            "introduced": "9.1.3"
        },
        {
            "last_affected": "9.1.3"
        },
        {
            "introduced": "9.1.4"
        },
        {
            "last_affected": "9.1.4"
        },
        {
            "introduced": "9.1.5"
        },
        {
            "last_affected": "9.1.5"
        },
        {
            "introduced": "9.1.6"
        },
        {
            "last_affected": "9.1.6"
        },
        {
            "introduced": "9.1.7"
        },
        {
            "last_affected": "9.1.7"
        },
        {
            "introduced": "9.2.0"
        },
        {
            "last_affected": "9.2.0"
        },
        {
            "introduced": "9.2.1"
        },
        {
            "last_affected": "9.2.1"
        },
        {
            "introduced": "9.2.2"
        },
        {
            "last_affected": "9.2.2"
        },
        {
            "introduced": "9.2.3"
        },
        {
            "last_affected": "9.2.3"
        },
        {
            "introduced": "9.2.4"
        },
        {
            "last_affected": "9.2.4"
        },
        {
            "introduced": "9.2.5"
        },
        {
            "last_affected": "9.2.5"
        },
        {
            "introduced": "9.2.6"
        },
        {
            "last_affected": "9.2.6"
        },
        {
            "introduced": "9.2.7"
        },
        {
            "last_affected": "9.2.7"
        }
    ]
}

Affected versions

9.*

9.0.0

9.0.1

9.0.10

9.0.2

9.0.3

9.0.4

9.0.5

9.0.6

9.0.7

9.0.8

9.0.9

9.1.0

9.1.1

9.1.2

9.1.3

9.1.4

9.1.5

9.1.6

9.1.7

9.2.0

9.2.1

9.2.2

9.2.3

9.2.4

9.2.5

9.2.6

9.2.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11438.json"