CVE-2014-8540

MEDIUM

GitLab 6.0.0-6.9.2 and 7.x < 7.4.3 - Authenticated Arbitrary Group Ownership Modification via Groups API

Title source: llm
STIX 2.1

Description

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98449
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/70841
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/10/31/2
Patch, Vendor Advisory x_refsource_confirm
https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released/

Scores

CVSS v3 6.5
EPSS 0.0032
EPSS Percentile 55.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-264
Status published
Products (1)
gitlab/gitlab 6.0.0 - 6.9.2
Published Jan 05, 2018
Tracked Since Feb 18, 2026