Skip to content
OpenAdvisories
High NCSC-2025-0070 5 CVEs

Kwetsbaarheden verholpen in GitLab

Published Mar 3, 2025 · Updated Mar 3, 2025 · nl

Vendor: GitLab Product: Community Edition, Enterprise Edition Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab CE/EE versies voor 17.7.6, 17.8.4 en 17.9.1.

Details

Interpretaties
De kwetsbaarheid bevindt zich in de mogelijkheid voor HTML-injectie in zoekopdrachten van child-items. Deze kwetsbaarheid kan door kwaadwillenden worden misbruikt om cross-site scripting (XSS) aanvallen uit te voeren. De mogelijkheid voor ongeautoriseerde scriptuitvoering kan leiden tot gegevensblootstelling of manipulatie.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 5

  • High 8.7
    CVE-2025-0475

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.

    GitLab GitLab Web / CMS
  • High 7.7
    CVE-2025-0555

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under spec…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2024-8186

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2024-10925

    Authorization Bypass Through User-Controlled Key in GitLab

    A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML

    GitLab GitLab Web / CMS
  • Unscored —
    CVE-2025-0307 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Revision history

  1. #0

    Initiele versie

References