CVE-2017-0925

HIGH

Gitlab EE <10.1.0 - Info Disclosure

Title source: llm

Description

Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.

References (3)

[Release Notes, Vendor Advisory] https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/

[Issue Tracking] https://gitlab.com/gitlab-org/gitlab-ee/issues/3847

[Third Party Advisory] https://www.debian.org/security/2018/dsa-4145

Scores

CVSS v3 7.2

EPSS 0.0010

EPSS Percentile 28.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-319 CWE-522

Status published

Affected Products (3)

gitlab/gitlab < 9.5.10

debian/debian_linux

Timeline

Published Mar 21, 2018

Tracked Since Feb 18, 2026