CVE-2018-17450: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The vulnerability (CVE-2018-17450) was disclosed on October 1, 2018, and involves a Server-Side Request Forgery (SSRF) vulnerability in the GitLab Kubernetes integration (GitLab Release, NVD).

The vulnerability is classified as Server-Side Request Forgery (SSRF) with a CVSS v3.1 Base Score of 4.3 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness is categorized as CWE-918 (Server-Side Request Forgery). The vulnerability allowed access to any URL accessible from the GitLab server (NVD, GitLab Release).

The vulnerability could allow attackers with access to the GitLab instance to determine the GCP service token for the GitLab host, particularly affecting users running GitLab on GCP. This could lead to unauthorized access to cloud resources (GitLab Release).

The vulnerability was patched in GitLab versions 11.3.1, 11.2.4, and 11.1.7 (Note: 11.1.7 was later found to still be vulnerable, and users were advised to upgrade to 11.1.8). GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Release).

The vulnerability was responsibly reported by security researcher @ngalog, who was credited in GitLab's security release announcement (GitLab Release).