Skip to content
CVE Tracker
Back

CVE-2017-0882

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in…

Medium6.3EPSS 1.1%
Published
Updated
Reserved
Assigned by
hackerone

Description

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

Scores

CVSS scores of CVE-2017-0882, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS (exploitation in 30 days)
1.1% · top 36% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

  • GitLab Community Edition and GitLab Enterprise Edition 8.7.0 through 8.15.7, 8.16.0 through 8.16.7, 8.17.0 through 8.17.3

    • affected GitLab Community Edition and GitLab Enterprise Edition 8.7.0 through 8.15.7, 8.16.0 through 8.16.7, 8.17.0 through 8.17.3

References (6)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .