CVE-2018-8801

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.mdRelease Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/41642Issue Tracking, Vendor Advisory
https://hackerone.com/reports/301924Exploit, Third Party Advisory
https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.mdRelease Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/41642Issue Tracking, Vendor Advisory
https://hackerone.com/reports/301924Exploit, Third Party Advisory

Timeline

Published: Apr 25, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-88028.1SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via u CVE-2018-88048.8WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double f CVE-2018-88056.1Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbo CVE-2018-88066.5In libming 0.4.8, there is a use-after-free in the decompileArithmeticOp function of decompile.c. Remote attackers could use this vulnerabil CVE-2018-88076.5In libming 0.4.8, these is a use-after-free in the function decompileCALLFUNCTION of decompile.c. Remote attackers could leverage this vulne CVE-2018-88085.5In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. Remote attackers could leverage this vu CVE-2018-88095.5In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. Remote attackers could leverage this vu CVE-2018-88105.5In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c. Remote attackers could leverage CVE-2018-88118.8Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers t CVE-2018-88134.8Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect user CVE-2018-88146.5Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for request CVE-2018-88154.6Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web s