CVE-2017-0882 : Multiple versions of GitLab expose sensitive user credentials when assigning a u

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

Published 2017-03-28 02:59:01

Updated 2019-10-09 23:21:07

Source HackerOne

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2017-0882

Gitlab » Gitlab » Version: 8.6.7
cpe:2.3:a:gitlab:gitlab:8.6.7:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.7.0
cpe:2.3:a:gitlab:gitlab:8.7.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.2.1
cpe:2.3:a:gitlab:gitlab:8.2.1:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.2.2
cpe:2.3:a:gitlab:gitlab:8.2.2:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.2.3
cpe:2.3:a:gitlab:gitlab:8.2.3:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.2.4
cpe:2.3:a:gitlab:gitlab:8.2.4:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.5.11
cpe:2.3:a:gitlab:gitlab:8.5.11:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.6.0
cpe:2.3:a:gitlab:gitlab:8.6.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.2.0
cpe:2.3:a:gitlab:gitlab:8.2.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.3.0
cpe:2.3:a:gitlab:gitlab:8.3.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.4.0
cpe:2.3:a:gitlab:gitlab:8.4.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.4.9
cpe:2.3:a:gitlab:gitlab:8.4.9:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.3.8
cpe:2.3:a:gitlab:gitlab:8.3.8:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.5.0
cpe:2.3:a:gitlab:gitlab:8.5.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.10.12
cpe:2.3:a:gitlab:gitlab:8.10.12:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.10.0
cpe:2.3:a:gitlab:gitlab:8.10.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.13.2
cpe:2.3:a:gitlab:gitlab:8.13.2:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.12.0
cpe:2.3:a:gitlab:gitlab:8.12.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.12.7
cpe:2.3:a:gitlab:gitlab:8.12.7:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.11.0
cpe:2.3:a:gitlab:gitlab:8.11.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.11.9
cpe:2.3:a:gitlab:gitlab:8.11.9:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.13.0
cpe:2.3:a:gitlab:gitlab:8.13.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.0
cpe:2.3:a:gitlab:gitlab:8.14.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.1
cpe:2.3:a:gitlab:gitlab:8.14.1:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.13.3
cpe:2.3:a:gitlab:gitlab:8.13.3:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.2
cpe:2.3:a:gitlab:gitlab:8.14.2:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.3
cpe:2.3:a:gitlab:gitlab:8.14.3:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.4
cpe:2.3:a:gitlab:gitlab:8.14.4:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.5
cpe:2.3:a:gitlab:gitlab:8.14.5:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.0
cpe:2.3:a:gitlab:gitlab:8.15.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.1
cpe:2.3:a:gitlab:gitlab:8.15.1:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.2
cpe:2.3:a:gitlab:gitlab:8.15.2:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.3
cpe:2.3:a:gitlab:gitlab:8.15.3:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.4.10
cpe:2.3:a:gitlab:gitlab:8.4.10:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.17.0
cpe:2.3:a:gitlab:gitlab:8.17.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.17.2
cpe:2.3:a:gitlab:gitlab:8.17.2:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.5
cpe:2.3:a:gitlab:gitlab:8.16.5:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.7
cpe:2.3:a:gitlab:gitlab:8.16.7:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.4
cpe:2.3:a:gitlab:gitlab:8.15.4:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.6
cpe:2.3:a:gitlab:gitlab:8.15.6:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.10.13
cpe:2.3:a:gitlab:gitlab:8.10.13:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.3.9
cpe:2.3:a:gitlab:gitlab:8.3.9:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.11.10
cpe:2.3:a:gitlab:gitlab:8.11.10:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.17.3
cpe:2.3:a:gitlab:gitlab:8.17.3:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.0
cpe:2.3:a:gitlab:gitlab:8.16.0:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.1
cpe:2.3:a:gitlab:gitlab:8.16.1:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.2
cpe:2.3:a:gitlab:gitlab:8.16.2:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.3
cpe:2.3:a:gitlab:gitlab:8.16.3:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.7.1
cpe:2.3:a:gitlab:gitlab:8.7.1:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.6.8
cpe:2.3:a:gitlab:gitlab:8.6.8:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.14.6
cpe:2.3:a:gitlab:gitlab:8.14.6:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.17.1
cpe:2.3:a:gitlab:gitlab:8.17.1:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.4
cpe:2.3:a:gitlab:gitlab:8.16.4:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.16.6
cpe:2.3:a:gitlab:gitlab:8.16.6:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.5
cpe:2.3:a:gitlab:gitlab:8.15.5:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.15.7
cpe:2.3:a:gitlab:gitlab:8.15.7:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.5.12
cpe:2.3:a:gitlab:gitlab:8.5.12:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.2.5
cpe:2.3:a:gitlab:gitlab:8.2.5:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab » Version: 8.12.8
cpe:2.3:a:gitlab:gitlab:8.12.8:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-0882

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-0882

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	2.8	3.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

CWE ids for CVE-2017-0882

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Assigned by: support@hackerone.com (Secondary)

References for CVE-2017-0882

https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5

Merge branch 'render-json-leak' into 'security' (cdf396f4) · Commits · GitLab.org / GitLab Community Edition · GitLab
Patch;Vendor Advisory
https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/

GitLab 8.17.4, 8.16.8, and 8.15.8 released | GitLab
Release Notes;Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b

Merge branch 'render-json-leak' into 'security' (a70346fc) · Commits · GitLab.org / GitLab Community Edition · GitLab
Patch;Vendor Advisory
http://www.securityfocus.com/bid/97157

GitLab CVE-2017-0882 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1

Merge branch 'render-json-leak' into 'security' (43f5a273) · Commits · GitLab.org / GitLab Community Edition · GitLab
Patch;Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/29661

JSON response in issue assignment leaks sensitive information (#29661) · Issues · GitLab.org / GitLab Community Edition · GitLab
Exploit;Vendor Advisory

Jump to

Vulnerability Details : CVE-2017-0882

Products affected by CVE-2017-0882

Exploit prediction scoring system (EPSS) score for CVE-2017-0882

CVSS scores for CVE-2017-0882

CWE ids for CVE-2017-0882

References for CVE-2017-0882