CVE-2018-17452
moderate-risk
Published 2023-04-15
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.
Do I need to act?
-
0.27% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: e7edd157fede812f5cc41cb3fae27370f2e4b5e4, e7edd157fede812f5cc41cb3fae27370f2e4b5e4, b5c7a88f7aab21a4f571916eab846340b52ad2f7, b5c7a88f7aab21a4f571916eab846340b52ad2f7
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Vendors
References (4)
Release Notes
https://about.gitlab.com/blog/categories/releases/
Release Notes
https://about.gitlab.com/blog/categories/releases/
43
/ 100
moderate-risk
Severity
32/34 · Critical
Exploitability
1/34 · Minimal
Exposure
10/34 · Low