CVE-2017-0915 describes a critical remote code execution vulnerability in GitLab Community Edition version 10.2.4, stemming from insufficient input validation within the GitlabProjectsImportService. This flaw carries a CVSS score of 9.8, indicating a critical risk with network-based exploitation, low attack complexity, and high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion, suggesting awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.9.0, <= 9.5.10CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 8.9.0, <= 9.5.10CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 10.0.0, <= 10.1.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 10.0.0, <= 10.1.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 10.2.0, <= 10.2.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.