CVE-2018-14602 : An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x befor

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames.

Published 2018-07-27 02:29:00

Updated 2018-09-18 18:25:50

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2018-14602

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-14602

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2018-14602

https://gitlab.com/gitlab-com/infrastructure/issues/4423

monitor.gitlab.net exposes private information (#4423) · Issues · GitLab.com / GitLab Infrastructure Team / infrastructure · GitLab
Vendor Advisory
https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/

GitLab Security Release: 11.1.2, 11.0.5, and 10.8.7 | GitLab
Release Notes;Vendor Advisory

CVEs referencing this url

Products affected by CVE-2018-14602

Gitlab » Gitlab » Enterprise Edition
Versions before (<) 10.8.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 11.0.0 and before (<) 11.0.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions before (<) 10.8.7
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 11.1.0 and before (<) 11.1.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 11.0.0 and before (<) 11.0.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 11.1.0 and before (<) 11.1.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions

Vulnerability Details : CVE-2018-14602

Exploit prediction scoring system (EPSS) score for CVE-2018-14602

CVSS scores for CVE-2018-14602

CWE ids for CVE-2018-14602

References for CVE-2018-14602

Products affected by CVE-2018-14602