CVE-2018-8801 is a Server-Side Request Forgery (SSRF) vulnerability affecting GitLab Community and Enterprise Editions versions 8.3 through 10.x before 10.3, specifically within the Services and webhooks component. With a CVSS score of 6.5 (MEDIUM), this vulnerability allows an authenticated attacker to perform unauthenticated requests to internal or external resources, potentially leading to information disclosure (C:H) without impacting integrity or availability. While no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is available and it is not listed in CISA's KEV catalog, the vulnerability has received limited community discussion and media coverage, primarily from GitLab's security advisories.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.3, < 10.3CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 8.3, < 10.3CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.