CVE-2017-0920 - AskarLabs CVE Database

CVE-2017-0920

Vendor Gitlab

Product GitLab Community and Enterprise Editions

Weakness CWE-639 · IDOR

Published March 22, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.

Key dates

02Disclosure timeline

March 22, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-0920 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2025-3089 Broken Access Control in ServiceNow AI Platform CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation CVE-2026-7782 CodeCanyon Perfex CRM Tenant Clients.php project authorization CVE-2024-3035 Authorization Bypass Through User-Controlled Key in GitLab CVE-2022-4798 Authorization Bypass Through User-Controlled Key in usememos/memos