The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 5.0.0 (including) | 5.4.2 (excluding) |
| Gitlab | Gitlab | 6.0.0 (including) | 6.2.1 (excluding) |
| Gitlab | Gitlab | 6.0.0 (including) | 6.2.4 (excluding) |
| Gitlab-shell | Gitlab | * | 1.7.8 (excluding) |