CVE-2014-8540

Published: Jan 5, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

Affected (2)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 6.0.0 to 6.9.2
Gitlab Gitlab	From 7.0.0 to 7.4.3

Related CWEs

CWE-264

References (10)

http://www.openwall.com/lists/oss-security/2014/10/31/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/70841

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released/

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/98449

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd

Source: cve@mitre.org

Patch

http://www.openwall.com/lists/oss-security/2014/10/31/2