{"id":"CVE-2017-0882","details":"Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.","modified":"2026-08-27T18:52:42.360917Z","published":"2017-03-28T02:59:01.497Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/97157"},{"type":"ADVISORY","url":"https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/"},{"type":"FIX","url":"https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1"},{"type":"FIX","url":"https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b"},{"type":"FIX","url":"https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5"},{"type":"EVIDENCE","url":"https://gitlab.com/gitlab-org/gitlab-ce/issues/29661"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/gitlab-org/gitlab","events":[{"introduced":"07140614ca47a39ac24c725298dd8ab9e9b6033f"},{"last_affected":"33f4b583cd25831cf10d6587c568bf6c99732476"}],"database_specific":{"cpe":["cpe:2.3:a:gitlab:gitlab:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.2.1:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.2.2:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.2.3:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.2.4:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.2.5:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.3.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.3.8:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.3.9:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.4.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.4.9:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.4.10:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.5.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.5.11:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.5.12:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.6.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.6.7:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.6.8:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.7.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.7.1:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.10.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.10.12:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.10.13:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.11.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.11.9:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.11.10:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.12.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.12.7:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.12.8:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.13.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.13.2:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.13.3:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.1:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.2:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.3:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.4:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.5:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.14.6:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.1:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.2:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.3:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.4:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.5:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.6:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.15.7:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.1:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.2:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.3:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.4:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.5:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.6:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.16.7:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.17.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.17.1:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.17.2:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:8.17.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.2.0"},{"last_affected":"8.2.0"},{"introduced":"8.2.1"},{"last_affected":"8.2.1"},{"introduced":"8.2.2"},{"last_affected":"8.2.2"},{"introduced":"8.2.3"},{"last_affected":"8.2.3"},{"introduced":"8.2.4"},{"last_affected":"8.2.4"},{"introduced":"8.2.5"},{"last_affected":"8.2.5"},{"introduced":"8.3.0"},{"last_affected":"8.3.0"},{"introduced":"8.3.8"},{"last_affected":"8.3.8"},{"introduced":"8.3.9"},{"last_affected":"8.3.9"},{"introduced":"8.4.0"},{"last_affected":"8.4.0"},{"introduced":"8.4.9"},{"last_affected":"8.4.9"},{"introduced":"8.4.10"},{"last_affected":"8.4.10"},{"introduced":"8.5.0"},{"last_affected":"8.5.0"},{"introduced":"8.5.11"},{"last_affected":"8.5.11"},{"introduced":"8.5.12"},{"last_affected":"8.5.12"},{"introduced":"8.6.0"},{"last_affected":"8.6.0"},{"introduced":"8.6.7"},{"last_affected":"8.6.7"},{"introduced":"8.6.8"},{"last_affected":"8.6.8"},{"introduced":"8.7.0"},{"last_affected":"8.7.0"},{"introduced":"8.7.1"},{"last_affected":"8.7.1"},{"introduced":"8.10.0"},{"last_affected":"8.10.0"},{"introduced":"8.10.12"},{"last_affected":"8.10.12"},{"introduced":"8.10.13"},{"last_affected":"8.10.13"},{"introduced":"8.11.0"},{"last_affected":"8.11.0"},{"introduced":"8.11.9"},{"last_affected":"8.11.9"},{"introduced":"8.11.10"},{"last_affected":"8.11.10"},{"introduced":"8.12.0"},{"last_affected":"8.12.0"},{"introduced":"8.12.7"},{"last_affected":"8.12.7"},{"introduced":"8.12.8"},{"last_affected":"8.12.8"},{"introduced":"8.13.0"},{"last_affected":"8.13.0"},{"introduced":"8.13.2"},{"last_affected":"8.13.2"},{"introduced":"8.13.3"},{"last_affected":"8.13.3"},{"introduced":"8.14.0"},{"last_affected":"8.14.0"},{"introduced":"8.14.1"},{"last_affected":"8.14.1"},{"introduced":"8.14.2"},{"last_affected":"8.14.2"},{"introduced":"8.14.3"},{"last_affected":"8.14.3"},{"introduced":"8.14.4"},{"last_affected":"8.14.4"},{"introduced":"8.14.5"},{"last_affected":"8.14.5"},{"introduced":"8.14.6"},{"last_affected":"8.14.6"},{"introduced":"8.15.0"},{"last_affected":"8.15.0"},{"introduced":"8.15.1"},{"last_affected":"8.15.1"},{"introduced":"8.15.2"},{"last_affected":"8.15.2"},{"introduced":"8.15.3"},{"last_affected":"8.15.3"},{"introduced":"8.15.4"},{"last_affected":"8.15.4"},{"introduced":"8.15.5"},{"last_affected":"8.15.5"},{"introduced":"8.15.6"},{"last_affected":"8.15.6"},{"introduced":"8.15.7"},{"last_affected":"8.15.7"},{"introduced":"8.16.0"},{"last_affected":"8.16.0"},{"introduced":"8.16.1"},{"last_affected":"8.16.1"},{"introduced":"8.16.2"},{"last_affected":"8.16.2"},{"introduced":"8.16.3"},{"last_affected":"8.16.3"},{"introduced":"8.16.4"},{"last_affected":"8.16.4"},{"introduced":"8.16.5"},{"last_affected":"8.16.5"},{"introduced":"8.16.6"},{"last_affected":"8.16.6"},{"introduced":"8.16.7"},{"last_affected":"8.16.7"},{"introduced":"8.17.0"},{"last_affected":"8.17.0"},{"introduced":"8.17.1"},{"last_affected":"8.17.1"},{"introduced":"8.17.2"},{"last_affected":"8.17.2"},{"introduced":"8.17.3"},{"last_affected":"8.17.3"}],"source":"CPE_STRING"}}],"versions":["8.10.0","8.10.12","8.10.13","8.11.0","8.11.10","8.11.9","8.12.0","8.12.7","8.12.8","8.13.0","8.13.2","8.13.3","8.14.0","8.14.1","8.14.2","8.14.3","8.14.4","8.14.5","8.14.6","8.15.0","8.15.1","8.15.2","8.15.3","8.15.4","8.15.5","8.15.6","8.15.7","8.16.0","8.16.1","8.16.2","8.16.3","8.16.4","8.16.5","8.16.6","8.16.7","8.17.0","8.17.1","8.17.2","8.17.3","8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.3.0","8.3.8","8.3.9","8.4.0","8.4.10","8.4.9","8.5.0","8.5.11","8.5.12","8.6.0","8.6.7","8.6.8","8.7.0","8.7.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0882.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}