2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"BFB57431-FE27-4D54-9A61-020DFD237029","versionEndExcluding":"10.1.6","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"84575803-64B2-4E3A-81A0-F1B964D91258","versionEndExcluding":"10.1.6","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"18CE7EFC-7939-4B85-8E2D-D9A584A303C3","versionEndExcluding":"10.2.6","versionStartIncluding":"10.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"42BEB1BB-7805-40E9-B323-525A0C2506AE","versionEndExcluding":"10.2.6","versionStartIncluding":"10.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"13F71B19-2DB0-453E-9020-947E26D61C38","versionEndExcluding":"10.3.4","versionStartIncluding":"10.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"18718016-0189-4AA9-8BD3-F0D172082B92","versionEndExcluding":"10.3.4","versionStartIncluding":"10.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized."},{"lang":"es","value":"Las ediciones Community y Enterprise de Gitlab, en versiones anteriores a la 10.1.6, 10.2.6 y 10.3.4, son vulnerables a un problema de omisión de autorización en el componente de importación de GitLab. Esto resulta en que un atacante puede realizar operaciones bajo un grupo en el que antes no estaban autorizados."}],"id":"CVE-2017-0919","lastModified":"2026-06-17T00:58:31.660","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-07-03T21:29:00.293","references":[{"source":"support@hackerone.com","tags":["Third Party Advisory"],"url":"https://hackerone.com/reports/301137"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://hackerone.com/reports/301137"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"nvd@nist.gov","type":"Primary"}]}
|