Server-side request forgery in Gitlab Community Edition - CVE-2018-18646
Published: October 30, 2018
Vulnerability identifier: #VU15571
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2018-18646
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform SSRF attack.
The weakness exists due to a SSRF issue in the GitLab Hipchat integration. A remote attacker can conduct a server-side request forgery (SSRF) attack and make requests to any local network resource accessible from the GitLab server.
Affected software
Gitlab Community Edition
Arch Linux
Arch Linux
How to mitigate CVE-2018-18646
The vulnerability has been fixed in the versions 11.4.3, 11.3.8, 11.2.7.
Gitlab Community Edition - addressed in versions 11.2.7, 11.3.8, 11.4.3