medium6.5
CVE-2014-8540
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permis…
Impact
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitlab | Gitlab | from 6.0.0 through 6.9.2 from 7.0.0 before 7.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2014/10/31/2
- http://www.securityfocus.com/bid/70841
- https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98449
- https://gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd
- http://www.openwall.com/lists/oss-security/2014/10/31/2
- http://www.securityfocus.com/bid/70841
- https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98449
- https://gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd