CVE-2018-8971

CRITICAL

GitLab < 10.3.9, 10.4.x < 10.4.6, 10.5.x < 10.5.6 - User Impersonation via Auth0 Misconfiguration

Title source: llm

Description

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4206

Scores

CVSS v3 9.8

EPSS 0.0018

EPSS Percentile 38.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (2)

debian/debian_linux 9.0

gitlab/gitlab < 10.3.8

Published Mar 24, 2018

Tracked Since Feb 18, 2026