CVE-2017-1000086: Incorrect Permission Assignment for Critical Resource
(updated )
The Periodic Backup Plugin does not perform any permission checks, allowing any user with Overall/Read
access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.
References
Detect and mitigate CVE-2017-1000086 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →