CVE-2017-17716
MEDIUM
5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
MEDIUM
4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: partial
Integrity: none
Availability: none
Description
AI Translation Available
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0009
Percentile
0,3th
Updated
EPSS Score Trend (Last 90 Days)
295
Improper Certificate Validation
DraftCommon Consequences
Security Scopes Affected:
Integrity
Authentication
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Applicable Platforms
Technologies:
Mobile, Not Technology-Specific, Web Based
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:rc3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:rc6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:rc2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:rc4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:rc5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.1:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Gitlab by Gitlab
CPE Identifier
View Detailed Analysis
cpe:2.3:a:gitlab:gitlab:9.4.0:rc1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ss…
https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/
https://gitlab.com/gitlab-org/gitlab-ce/issues/30420
https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ss…
https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/
https://gitlab.com/gitlab-org/gitlab-ce/issues/30420