CVE-2016-4340

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/138368/GitLab-Impersonate-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/Mitigation, Patch, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/15548Issue Tracking, Patch, Vendor Advisory
https://www.exploit-db.com/exploits/40236/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/138368/GitLab-Impersonate-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/Mitigation, Patch, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/15548Issue Tracking, Patch, Vendor Advisory
https://www.exploit-db.com/exploits/40236/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-43417.5NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors.CVE-2016-43428.8ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allow CVE-2016-43438.8The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files,CVE-2016-43449.8Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service o CVE-2016-43459.8Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows remote attackers to cau CVE-2016-43469.8Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service o CVE-2016-43487.5The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumpt CVE-2016-43497.8Untrusted search path vulnerability in Cisco WebEx Productivity Tools 2.40.5001.10012 allows local users to gain privileges via a Trojan hor CVE-2016-43509.8Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storag CVE-2016-43519.8SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows CVE-2016-43525.5Integer overflow in the demuxer function in libmpdemux/demux_gif.c in Mplayer allows remote attackers to cause a denial of service (crash) v CVE-2016-43537.5ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of s