Описание
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
Ссылки
- Vendor Advisory
- ExploitIssue TrackingVendor Advisory
- Permissions RequiredThird Party Advisory
- Vendor Advisory
- ExploitIssue TrackingVendor Advisory
- Permissions RequiredThird Party Advisory
- US Government Resource
Уязвимые конфигурации
Одно из
EPSS
6.8 Medium
CVSS3
9.8 Critical
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
When requests to the internal network for webhooks are enabled, a serv ...
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостаточной проверкой поступающих запросов, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
6.8 Medium
CVSS3
9.8 Critical
CVSS3
6.8 Medium
CVSS2