CVE-2017-0921

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-03 · updated 2026-06-17
Weakness: CWE-640

Description

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.

Affected products

GitLab: before 10.1.6; from 10.2.0 before 10.2.6; from 10.3.0 before 10.3.4 — fixed in 10.1.6, 10.2.6, 10.3.4

How to fix

Upgrade to a fixed version: GitLab 10.1.6, 10.2.6, 10.3.4. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/
https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/

Get alerted when CVE-2017-0921 or the next vulnerability affects your stack