High
Security advisory
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-0921
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:09 UTC · Revision 1
Source evidence
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.
osv:CVE-2017-0921
Complete source record
{
"id": "8733aee30c1c53eb2dabf403733de6d5466e88e72078cfb1a0f80d1c18b82a14",
"url": "https://osv.dev/vulnerability/CVE-2017-0921",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-0921",
"summary": "GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.",
"evidence": "osv:CVE-2017-0921",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-0921",
"aliases": [
"CVE-2017-0921"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/gitlab-org/gitlab",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0c1dc982000dc78b0ba68700f74f78a8a72584fe"
},
{
"introduced": "d90716aff22310b27734df86d287d2cb4084fdbb"
},
{
"fixed": "bf756fb1e0968aa25ff444358c9c50b568b5b7f5"
},
{
"introduced": "6369db0196ec7b6e288b16382c95243424a59b62"
},
{
"fixed": "00c14addea672f44ff6b470acf9b41c485db73af"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "10.1.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "10.1.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "10.2.0"
},
{
"fixed": "10.2.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "10.2.0"
},
{
"fixed": "10.2.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v10.3.3-ee",
"v10.2.5-ee",
"v10.3.2-ee",
"v10.3.1-ee",
"v10.3.0-ee",
"v10.3.0-rc5-ee",
"v10.3.0-rc4-ee",
"v10.3.0-rc3-ee",
"v10.3.0-rc2-ee",
"v10.3.0-rc1-ee",
"v10.1.5-ee",
"v10.2.4-ee",
"v10.2.3-ee",
"v10.1.4-ee",
"v10.2.2-ee",
"v10.2.1-ee",
"v10.2.0-ee",
"v10.2.0-rc4-ee",
"v10.2.0-rc3-ee",
"v10.2.0-rc2-ee",
"v10.1.3-ee",
"v10.2.0-rc1-ee",
"v10.1.2-ee",
"v10.1.1-ee",
"v10.1.0-ee",
"v10.1.0-rc4-ee",
"v10.1.0-rc3-ee",
"v10.1.0-rc2-ee",
"v10.1.0-rc1-ee",
"v7.3.0-ee",
"v7.3.0.rc1-ee",
"v7.2.0.rc5-ee",
"v7.2.0.rc4-ee",
"v7.2.0.rc3-ee",
"v7.2.0.rc2-ee",
"v7.2.0.rc1-ee",
"v7.1.0-ee",
"v7.1.0.rc1-ee",
"v7.0.0-ee",
"v6.8.0-ee",
"v6.7.0-ee",
"v6.7.0.rc1-ee",
"v6.6.0-ee",
"v6.5.0-ee",
"v6.4.0-ee",
"v6.3.1-ee",
"v6.3.0-ee",
"v6.1.0-ee",
"v6.0.0-ee",
"v6.0.0-ee.rc1",
"v6.0.0-ee.beta",
"v5.2.0",
"v5.1.0",
"v5.0.0",
"v4.0.0",
"v4.0.0rc2",
"v4.0.0rc1",
"v3.1.0",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.9.1",
"v2.9.0",
"v2.8.2",
"v2.8.1",
"v2.8.0",
"v2.8.0pre",
"v2.7.0",
"v2.7.0pre",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.6.0pre",
"v2.5.0",
"v2.4.1",
"v2.4.0",
"v2.4.0pre",
"v2.3.1",
"v2.3.0",
"v2.3.0pre",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.2.0pre"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0921.json"
}
}
],
"modified": "2026-10-30T10:30:16.630373871Z",
"provider": "osv",
"references": [
"https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-0921",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 433910,
"published_at": "2018-07-03T21:29:00.34+00:00"
}