CVE-2017-0925 describes an insufficiently protected credential issue in GitLab Enterprise Edition version 10.1.0's project service integration API endpoint, leading to plaintext password disclosure. This vulnerability carries a high CVSS score of 7.2, indicating a network-based attack with low complexity, requiring high privileges, and potentially resulting in complete compromise of confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) is available and it's not in CISA's KEV catalog, there is limited community discussion and media coverage, suggesting it's not widely exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.0.0, <= 9.5.10CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 8.0.0, <= 9.5.10CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 10.0.0, <= 10.1.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 10.0.0, <= 10.1.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 10.2.0, <= 10.2.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.