CVE-2016-4340

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

CVSS v3.0 NVD

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

10.14% chance of exploitation in the next 30 days, 96th percentile

Published

2017-01-23

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/138368/GitLab-Impersonate-Privilege-Escalation.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40236

Security advisories

• https://about.gitlab.com/2016/05/02/cve-2016-4340-patches
• https://gitlab.com/gitlab-org/gitlab-ce/issues/15548

References

• CVE Record
• NVD entry