Homepage

Access Restriction Bypass The advisory has been revoked - it doesn't affect any version of package gitlab  (opens in a new tab)

Threat Intelligence

EPSS
2.4% (84th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN9-GITLAB-317208
  • published28 Mar 2017
  • disclosed28 Mar 2017
Report a new vulnerability Found a mistake?

Introduced: 28 Mar 2017

CVE-2016-9469  (opens in a new tab)
CWE-264  (opens in a new tab)
CWE-749  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gitlab package and not the gitlab package as distributed by Debian.

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix was included in versions 8.14.3, 8.13.8, and 8.12.11, which were released on December 5th 2016 at 3:59 PST. The GitLab versions vulnerable to this are 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1, 8.14.2, and 8.14.2-ee.