2 lines
6.0 KiB
JSON
2 lines
6.0 KiB
JSON
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"18.8.7","status":"affected","version":"14.3","versionType":"semver"},{"lessThan":"18.9.3","status":"affected","version":"18.9","versionType":"semver"},{"lessThan":"18.10.1","status":"affected","version":"18.10","versionType":"semver"}]}],"source":"cve@gitlab.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_pipelines:1"],"defaultStatus":"unaffected","packageName":"openshift-pipelines/pipelines-console-plugin-rhel9","product":"OpenShift Pipelines","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"22F9C9B9-964C-421E-8CB5-B2FBE5E5A84F","versionEndExcluding":"18.8.7","versionStartIncluding":"14.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"F419394A-3E12-4548-BD49-FF5027B9CFF7","versionEndExcluding":"18.8.7","versionStartIncluding":"14.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"96F7E7EC-4C2E-4A48-8134-9262B251C89C","versionEndExcluding":"18.9.3","versionStartIncluding":"18.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"C3240349-67A3-43E2-BAD9-EFAA3E0A5D31","versionEndExcluding":"18.9.3","versionStartIncluding":"18.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:community:*:*:*","matchCriteriaId":"D5B6ECC9-6AEA-4DD0-B12B-A3A7A9FE91DA","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"2B8DF779-B99E-4096-B734-78AB1849D136","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks."},{"lang":"es","value":"GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 14.3 anteriores a la 18.8.7, la 18.9 anteriores a la 18.9.3 y la 18.10 anteriores a la 18.10.1, y que afecta a las instalaciones de Jira Connect, que podría haber permitido a un usuario autenticado con permisos mínimos de espacio de trabajo obtener credenciales de instalación e suplantar la aplicación de GitLab debido a comprobaciones de autorización incorrectas."}],"id":"CVE-2026-2370","lastModified":"2026-07-15T02:19:30.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-30T15:01:52.806448Z","version":"2.0.3"}}]},"published":"2026-03-30T00:16:01.800","references":[{"source":"cve@gitlab.com","tags":["Patch","Release Notes"],"url":"https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/589635"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3522829"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-2370"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452920"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2370.json"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-233"}],"source":"cve@gitlab.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-233"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
|