CVE-2016-4340

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

10.14% chance of exploitation in the next 30 days, 95th percentile

Published

2017-01-23

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/138368/GitLab-Impersonate-Privilege-Escalation.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40236

References

• CVE Record
• NVD entry

Related

• CVE-2016-4338
• CVE-2016-4343
• CVE-2016-4337
• CVE-2016-4344
• CVE-2016-4336
• CVE-2016-4345