CVE-2018-3710

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-377 CWE-22

Affected software

Vendor	Product	Versions
GitLab	GitLab Community and Enterprise Editions	8.9 - 10.1.5 Fixed in 10.1.6; 10.2.0 - 10.2.5 Fixed in 10.2.6; 10.3.0 - 10.3.3 Fixed in 10.3.4

References

https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/Vendor Advisory
https://gitlab.com/gitlab-com/infrastructure/issues/3510Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/41757Vendor Advisory
https://hackerone.com/reports/302959Permissions Required
https://www.debian.org/security/2018/dsa-4145Third Party Advisory
https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/Vendor Advisory
https://gitlab.com/gitlab-com/infrastructure/issues/3510Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/41757Vendor Advisory
https://hackerone.com/reports/302959Permissions Required
https://www.debian.org/security/2018/dsa-4145Third Party Advisory

Timeline

Published: Mar 21, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-37117.5Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and CVE-2018-37126.5serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in path CVE-2018-37136.5angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a ma CVE-2018-37146.5node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read con CVE-2018-37156.5glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a m CVE-2018-37165.4simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.CVE-2018-37175.4connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.j CVE-2018-37185.3serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.CVE-2018-37198.8mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use CVE-2018-37208.8assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious us CVE-2018-37216.5lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer CVE-2018-37228.8merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use