CVE-2018-18645

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/24498Exploit, Issue Tracking, Vendor Advisory
https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/24498Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Dec 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-186468.8An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows CVE-2018-186476.5An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Mis CVE-2018-186487.5An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Inf CVE-2018-186499.8An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11 CVE-2018-186505.5An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service (Integer Overflow) via CVE-2018-186515.5An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by l CVE-2018-186527.2A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrar CVE-2018-186537.8The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Se CVE-2018-186547.8Crossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local attacker can first create a world-writable subdire CVE-2018-186554.3Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lack CVE-2018-186567.8The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The location of such files is %PR CVE-2018-186577.5An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive