CVE-2017-11438

Published: Aug 2, 2017Modified: May 13, 2026

6.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: NVD

Description

GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.

Affected (54)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

54 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	Version 9.0.0
Gitlab Gitlab	Version 9.0.0
Gitlab Gitlab	Version 9.0.10
Gitlab Gitlab	Version 9.0.10
Gitlab Gitlab	Version 9.0.1
Gitlab Gitlab	Version 9.0.1
Gitlab Gitlab	Version 9.0.2
Gitlab Gitlab	Version 9.0.2
Gitlab Gitlab	Version 9.0.3
Gitlab Gitlab	Version 9.0.3
Gitlab Gitlab	Version 9.0.4
Gitlab Gitlab	Version 9.0.4
Gitlab Gitlab	Version 9.0.5
Gitlab Gitlab	Version 9.0.5
Gitlab Gitlab	Version 9.0.6
Gitlab Gitlab	Version 9.0.6
Gitlab Gitlab	Version 9.0.7
Gitlab Gitlab	Version 9.0.7
Gitlab Gitlab	Version 9.0.8
Gitlab Gitlab	Version 9.0.8
Gitlab Gitlab	Version 9.0.9
Gitlab Gitlab	Version 9.0.9
Gitlab Gitlab	Version 9.1.0
Gitlab Gitlab	Version 9.1.0
Gitlab Gitlab	Version 9.1.1
Gitlab Gitlab	Version 9.1.1
Gitlab Gitlab	Version 9.1.2
Gitlab Gitlab	Version 9.1.2
Gitlab Gitlab	Version 9.1.3
Gitlab Gitlab	Version 9.1.3
Gitlab Gitlab	Version 9.1.4
Gitlab Gitlab	Version 9.1.4
Gitlab Gitlab	Version 9.1.5
Gitlab Gitlab	Version 9.1.5
Gitlab Gitlab	Version 9.1.6
Gitlab Gitlab	Version 9.1.6
Gitlab Gitlab	Version 9.1.7
Gitlab Gitlab	Version 9.1.7
Gitlab Gitlab	Version 9.2.0
Gitlab Gitlab	Version 9.2.0
Gitlab Gitlab	Version 9.2.1
Gitlab Gitlab	Version 9.2.1
Gitlab Gitlab	Version 9.2.2
Gitlab Gitlab	Version 9.2.2
Gitlab Gitlab	Version 9.2.3
Gitlab Gitlab	Version 9.2.3
Gitlab Gitlab	Version 9.2.4
Gitlab Gitlab	Version 9.2.4
Gitlab Gitlab	Version 9.2.5
Gitlab Gitlab	Version 9.2.5
Gitlab Gitlab	Version 9.2.6
Gitlab Gitlab	Version 9.2.6
Gitlab Gitlab	Version 9.2.7
Gitlab Gitlab	Version 9.2.7

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/

Source: cve@mitre.org

Release NotesVendor Advisory

https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.