CVE-2016-4340 The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as a...
HighCVSS 8.8
EPSS 10.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitlab | = 8.2.0 | No fix listed |
| gitlab | = 8.2.1 | No fix listed |
| gitlab | = 8.2.2 | No fix listed |
| gitlab | = 8.2.3 | No fix listed |
| gitlab | = 8.2.4 | No fix listed |
| gitlab | = 8.3.0 | No fix listed |
| gitlab | = 8.3.1 | No fix listed |
| gitlab | = 8.3.2 | No fix listed |
| gitlab | = 8.3.3 | No fix listed |
| gitlab | = 8.3.4 | No fix listed |
| gitlab | = 8.3.5 | No fix listed |
| gitlab | = 8.3.6 | No fix listed |
| gitlab | = 8.3.7 | No fix listed |
| gitlab | = 8.3.8 | No fix listed |
| gitlab | = 8.4.0 | No fix listed |
| gitlab | = 8.4.1 | No fix listed |
| gitlab | = 8.4.2 | No fix listed |
| gitlab | = 8.4.3 | No fix listed |
| gitlab | = 8.4.4 | No fix listed |
| gitlab | = 8.4.5 | No fix listed |
| gitlab | = 8.4.6 | No fix listed |
| gitlab | = 8.4.7 | No fix listed |
| gitlab | = 8.4.8 | No fix listed |
| gitlab | = 8.4.9 | No fix listed |
| gitlab | = 8.5.0 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| gitlab | = 8.5.1 | No fix listed |
| gitlab | = 8.5.2 | No fix listed |
| gitlab | = 8.5.3 | No fix listed |
| gitlab | = 8.5.4 | No fix listed |
| gitlab | = 8.5.5 | No fix listed |
| gitlab | = 8.5.6 | No fix listed |
| gitlab | = 8.5.7 | No fix listed |
| gitlab | = 8.5.8 | No fix listed |
| gitlab | = 8.5.9 | No fix listed |
| gitlab | = 8.5.10 | No fix listed |
| gitlab | = 8.5.11 | No fix listed |
| gitlab | = 8.6.0 | No fix listed |
| gitlab | = 8.6.1 | No fix listed |
| gitlab | = 8.6.2 | No fix listed |
| gitlab | = 8.6.3 | No fix listed |
| gitlab | = 8.6.4 | No fix listed |
| gitlab | = 8.6.5 | No fix listed |
| gitlab | = 8.6.6 | No fix listed |
| gitlab | = 8.6.7 | No fix listed |
| gitlab | = 8.7.0 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- about.gitlab.com mitigation patch vendor-advisory
- gitlab.com issue-tracking patch vendor-advisory
- 40236 exploit third-party-advisory vdb-entry