VDB
CVE-2017-12426
CVE-2017-12426
PUBLISHED
CVSS 8.800000190734863 HIGH
GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.
EPSS 3.54% · 89.2th percentile
Risk Scores
CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
3.54%
89.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | gitlab | 0, 8.4.3+dfsg-12, 8.5.8+dfsg-5 |
Timeline
- Aug 14, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Mar 17, 2025 EPSS Score
- Mar 19, 2025 EPSS Score
- Mar 21, 2025 EPSS Score
- Mar 27, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Mar 30, 2025 EPSS Score
- Apr 8, 2025 EPSS Score
- Apr 9, 2025 EPSS Score
- Apr 15, 2025 EPSS Score
- Apr 17, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-12426 third-party-advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/35212 third-party-advisory
- https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/ third-party-advisory
- https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1466490.html third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-12426 third-party-advisory