CVE-2017-0882

2017-03-2802:46:00

CWE-639

hackerone

www.cve.org

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

CNA Affected

[
  {
    "product": "GitLab Community Edition and GitLab Enterprise Edition 8.7.0 through 8.15.7, 8.16.0 through 8.16.7, 8.17.0 through 8.17.3",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "GitLab Community Edition and GitLab Enterprise Edition 8.7.0 through 8.15.7, 8.16.0 through 8.16.7, 8.17.0 through 8.17.3"
      }
    ]
  }
]