CVE Vulnerabilities

CVE-2018-17452

Server-Side Request Forgery (SSRF)

Published: Apr 15, 2023 | Modified: Apr 25, 2023
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

Weakness

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Software

Name Vendor Start Version End Version
Gitlab Gitlab * 11.1.7 (excluding)
Gitlab Gitlab 11.2.0 (including) 11.2.4 (excluding)
Gitlab Gitlab 11.3.0 (including) 11.3.0 (including)

References