CVE-2018-18644 is an information exposure vulnerability affecting GitLab Community and Enterprise Editions (versions 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3) through its Prometheus integration. Rated Medium (CVSS 6.5), this vulnerability allows an authenticated attacker with low privileges to remotely access sensitive information with high confidentiality impact, without requiring user interaction. There is no evidence of active exploitation, nor are there public exploit codes like Metasploit or Nuclei modules, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 11.2.0, < 11.2.7CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 11.2.0, < 11.2.7CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 11.3.0, < 11.3.8CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 11.3.0, < 11.3.8CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 11.4.0, < 11.4.3CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.