CVE-2017-11437
N/A
Published: August 2, 2017 at 07:00 PM UTC
Updated: June 17, 2026 at 01:01 AM UTC
1 product affected across 1 vendorGitLab
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.8%
Description
GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
8.10.08.10.18.10.108.10.118.10.128.10.138.10.28.10.38.10.48.10.58.10.68.10.78.10.88.10.98.11.08.11.18.11.108.11.118.11.28.11.38.11.48.11.58.11.68.11.78.11.88.11.98.12.08.12.18.12.108.12.118.12.128.12.28.12.38.12.48.12.58.12.68.12.78.12.88.12.98.13.08.13.18.13.108.13.118.13.28.13.38.13.48.13.58.13.68.13.78.13.88.13.98.14.08.14.18.14.108.14.28.14.38.14.48.14.58.14.68.14.88.14.98.15.08.15.18.15.28.15.38.15.48.15.68.15.78.15.88.16.08.16.18.16.28.16.38.16.48.16.58.16.68.16.78.16.88.16.98.17.08.17.18.17.28.17.38.17.48.17.58.17.68.5.08.5.18.5.108.5.118.5.128.5.138.5.28.5.38.5.48.5.58.5.68.5.78.5.88.5.98.6.08.6.18.6.28.6.38.6.48.6.58.6.68.6.78.6.88.6.98.7.08.7.18.7.28.7.38.7.48.7.58.7.68.7.78.7.88.7.98.8.08.8.18.8.28.8.38.8.48.8.58.8.68.8.78.8.88.8.98.9.08.9.18.9.108.9.118.9.28.9.38.9.48.9.58.9.68.9.79.0.09.0.19.0.109.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.99.1.09.1.19.1.29.1.39.1.49.1.59.1.69.1.79.2.09.2.19.2.29.2.39.2.49.2.59.2.69.2.79.3.09.3.19.3.29.3.39.3.49.3.59.3.69.3.7
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/Quick Info
StatusMODIFIED
CWE
CWE-732
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card