Описание
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
Ссылки
- PatchRelease NotesVendor Advisory
- ExploitVendor Advisory
- Permissions Required
- PatchRelease NotesVendor Advisory
- ExploitVendor Advisory
- Permissions Required
Уязвимые конфигурации
Конфигурация 1Версия от 11.8.0 (включая) до 11.11.6 (исключая)Версия от 12.0.0 (включая) до 12.0.4 (исключая)Версия от 12.1.0 (включая) до 12.1.2 (исключая)
Одно из
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
EPSS
Процентиль: 38%
0.00166
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-284
CWE-863
Связанные уязвимости
CVSS3: 6.5
ubuntu
около 6 лет назад
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
CVSS3: 6.5
debian
около 6 лет назад
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, ...
CVSS3: 6.5
github
больше 3 лет назад
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
EPSS
Процентиль: 38%
0.00166
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-284
CWE-863