Описание
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
| Релиз | Статус | Примечание |
|---|---|---|
| esm-apps/xenial | ignored | not maintainable |
| trusty | ignored | end of standard support |
| upstream | needs-triage | |
| xenial | ignored | end of standard support |
Показывать по
EPSS
7.5 High
CVSS2
9.1 Critical
CVSS3
Связанные уязвимости
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
A hardcoded password was set for accounts registered using an OmniAuth ...
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
Уязвимость программной платформы для совместной работы над кодом GitLab, связанная с установкой предопределённых (hardcoded) паролей для учётных записей, зарегистрированных с использованием провайдера OmniAuth (OAuth, LDAP и SAML), позволяющая нарушителю получить доступ к учетным записям пользователей
EPSS
7.5 High
CVSS2
9.1 Critical
CVSS3