Design/Logic Flaw

2018-01-0516:29:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.1%

JSON

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

CPENameOperatorVersion
gitlabge6.0.0
gitlable6.9.2
gitlabge7.0.0
gitlablt7.4.3

Name	Operator	Version
gitlab	ge	6.0.0
gitlab	le	6.9.2
gitlab	ge	7.0.0
gitlab	lt	7.4.3

References

www.openwall.com/lists/oss-security/2014/10/31/2

www.securityfocus.com/bid/70841

about.gitlab.com/2014/10/30/gitlab-7-4-3-released/

exchange.xforce.ibmcloud.com/vulnerabilities/98449

gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd