GitLab CVE-2018-20229 Directory Traversal Vulnerability
BID:107783
Info
GitLab CVE-2018-20229 Directory Traversal Vulnerability
| Bugtraq ID: | 107783 |
| Class: | Input Validation Error |
| CVE: |
CVE-2018-20229 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 20 2018 12:00AM |
| Updated: | Dec 20 2018 12:00AM |
| Credit: | @nyangawa of Chaitin Tech and @mishre |
| Vulnerable: |
Gitlab GitLab Enterprise Edition 11.5.4 Gitlab GitLab Enterprise Edition 11.5.3 Gitlab GitLab Enterprise Edition 11.5.2 Gitlab GitLab Enterprise Edition 11.5 Gitlab GitLab Enterprise Edition 11.4.11 Gitlab GitLab Enterprise Edition 11.4.10 Gitlab GitLab Enterprise Edition 11.4.9 Gitlab GitLab Enterprise Edition 11.4 Gitlab GitLab Enterprise Edition 11.3.13 Gitlab GitLab Enterprise Edition 11.3.12 Gitlab GitLab Enterprise Edition 11.3.11 Gitlab GitLab Enterprise Edition 11.3 Gitlab GitLab Enterprise Edition 10.7.2 Gitlab GitLab Enterprise Edition 10.7 Gitlab GitLab Enterprise Edition 10.6.5 Gitlab GitLab Enterprise Edition 10.6 Gitlab GitLab Enterprise Edition 10.5.8 Gitlab GitLab Enterprise Edition 10.5 Gitlab GitLab Community Edition 11.5.4 Gitlab GitLab Community Edition 11.5.3 Gitlab GitLab Community Edition 11.5.2 Gitlab GitLab Community Edition 11.5 Gitlab GitLab Community Edition 11.4.11 Gitlab GitLab Community Edition 11.4.10 Gitlab GitLab Community Edition 11.4.9 Gitlab GitLab Community Edition 11.4 Gitlab GitLab Community Edition 11.3.13 Gitlab GitLab Community Edition 11.3.12 Gitlab GitLab Community Edition 11.3.11 Gitlab GitLab Community Edition 11.3 Gitlab GitLab Community Edition 10.7.2 Gitlab GitLab Community Edition 10.7 Gitlab GitLab Community Edition 10.6.5 Gitlab GitLab Community Edition 10.6 Gitlab GitLab Community Edition 10.5.8 Gitlab GitLab Community Edition 10.5 |
| Not Vulnerable: |
Gitlab GitLab Enterprise Edition 11.5.5 Gitlab GitLab Enterprise Edition 11.4.12 Gitlab GitLab Enterprise Edition 11.3.14 Gitlab GitLab Community Edition 11.5.5 Gitlab GitLab Community Edition 11.4.12 Gitlab GitLab Community Edition 11.3.14 |
Discussion
GitLab CVE-2018-20229 Directory Traversal Vulnerability
GitLab is prone to a directory-traversal vulnerability.
Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve sensitive information. This may aid in further attacks.
The following products are affected:
GitLab Community Edition prior to 11.3.14, 11.4.x prior to 11.4.12, and 11.5.x prior to11.5.5
GitLab Enterprsie Edition prior to 11.3.14, 11.4.x prior to 11.4.12, and 11.5.x prior to11.5.5
GitLab is prone to a directory-traversal vulnerability.
Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve sensitive information. This may aid in further attacks.
The following products are affected:
GitLab Community Edition prior to 11.3.14, 11.4.x prior to 11.4.12, and 11.5.x prior to11.5.5
GitLab Enterprsie Edition prior to 11.3.14, 11.4.x prior to 11.4.12, and 11.5.x prior to11.5.5
Exploit / POC
GitLab CVE-2018-20229 Directory Traversal Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GitLab CVE-2018-20229 Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
GitLab CVE-2018-20229 Directory Traversal Vulnerability
References:
References:
- GitLab Homepage (GitLab.org)
- Gitlab Releases (Gitlab )
- GitLab Critical Security Release: 11.5.5, 11.4.12, 11.3.14 (Gitlab)