CVE-2018-17455

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-17455
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17455.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-17455
Downstream
Related
Published
2023-04-15T23:15:13.637Z
Modified
2026-08-27T18:52:52.700859Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e7edd157fede812f5cc41cb3fae27370f2e4b5e4
Introduced
44dbeccbe1039cb1d42d8502655ffb0bce3ae803
Fixed
b5c7a88f7aab21a4f571916eab846340b52ad2f7
Introduced
1bbe39452664021af90851aef8527ce5e850343e
Last affected
1bbe39452664021af90851aef8527ce5e850343e
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:11.3.0:*:*:*:community:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:11.3.0:*:*:*:enterprise:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.1.7"
        },
        {
            "introduced": "11.2.0"
        },
        {
            "fixed": "11.2.4"
        },
        {
            "introduced": "11.3.0"
        },
        {
            "last_affected": "11.3.0"
        }
    ]
}

Affected versions

11.*
11.3.0
v1.*
v1.2.0
v1.2.0pre
v1.2.1
v1.2.2
v11.*
v11.1.0-ee
v11.1.0-rc1-ee
v11.1.0-rc10-ee
v11.1.0-rc11-ee
v11.1.0-rc12-ee
v11.1.0-rc13-ee
v11.1.0-rc14-ee
v11.1.0-rc2-ee
v11.1.0-rc3-ee
v11.1.0-rc4-ee
v11.1.0-rc5-ee
v11.1.0-rc6-ee
v11.1.0-rc7-ee
v11.1.0-rc8-ee
v11.1.0-rc9-ee
v11.1.1-ee
v11.1.2-ee
v11.1.3-ee
v11.1.4-ee
v11.1.5-ee
v11.1.6-ee
v11.2.0-ee
v11.2.0-rc1-ee
v11.2.0-rc10-ee
v11.2.0-rc2-ee
v11.2.0-rc3-ee
v11.2.0-rc4-ee
v11.2.0-rc5-ee
v11.2.0-rc6-ee
v11.2.0-rc7-ee
v11.2.0-rc8-ee
v11.2.0-rc9-ee
v11.2.1-ee
v11.2.2-ee
v11.2.3-ee
v11.3.0.pre
v2.*
v2.3.0
v2.3.0pre
v2.3.1
v2.4.0
v2.4.0pre
v2.4.1
v2.5.0
v2.6.0
v2.6.0pre
v2.6.1
v2.6.2
v2.6.3
v2.7.0
v2.7.0pre
v2.8.0
v2.8.0pre
v2.8.1
v2.8.2
v2.9.0
v2.9.1
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v4.*
v4.0.0
v4.0.0rc1
v4.0.0rc2
v5.*
v5.0.0
v5.1.0
v5.2.0
v6.*
v6.0.0-ee
v6.0.0-ee.beta
v6.0.0-ee.rc1
v6.1.0-ee
v6.3.0-ee
v6.3.1-ee
v6.4.0-ee
v6.5.0-ee
v6.6.0-ee
v6.7.0-ee
v6.7.0.rc1-ee
v6.8.0-ee
v7.*
v7.0.0-ee
v7.1.0-ee
v7.1.0.rc1-ee
v7.2.0.rc1-ee
v7.2.0.rc2-ee
v7.2.0.rc3-ee
v7.2.0.rc4-ee
v7.2.0.rc5-ee
v7.3.0-ee
v7.3.0.rc1-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17455.json"