Information disclosure in Gitlab Community Edition - CVE-2018-18645
Published: October 30, 2018
Vulnerability identifier: #VU15576
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18645
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to user's unsubscribe link can be included in the issue when replying to an issue through email, with the GitLab email footer included. A remote attacker can view arbitrary data.
Affected software
Gitlab Community Edition
Arch Linux
Arch Linux
How to mitigate CVE-2018-18645
The vulnerability has been fixed in the versions 11.4.3, 11.3.8, 11.2.7.
Gitlab Community Edition - addressed in versions 11.2.7, 11.3.8, 11.4.3