Skip to content
OpenAdvisories
High NCSC-2025-0087 9 CVEs

Kwetsbaarheden verholpen in GitLab

Published Mar 14, 2025 · Updated Mar 14, 2025 · nl

Vendor: GitLab Product: Community Edition, Enterprise Edition Product: Enterprise Edition Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab EE/CE versies van 11.5 tot 17.9.2.

Details

Interpretaties
De kwetsbaarheden omvatten onder andere een probleem waarbij gebruikers met aangepaste rechten meer lidmaatschapsverzoeken kunnen goedkeuren dan waar ze recht op hebben, wat kan leiden tot ongeautoriseerde toegang tot beperkte gebieden binnen het platform. Daarnaast zijn er kwetsbaarheden in de Google Cloud IAM-integratiefunctie die kwaadwillenden in staat kunnen stellen om kwaadaardige code in het systeem in te voeren. Er zijn ook kwetsbaarheden die gevoelige authenticatie-informatie kunnen blootstellen en een denial-of-service kunnen veroorzaken door manipulatie van specifieke invoer. Bovendien zijn er kritieke kwetsbaarheden in de ruby-saml-bibliotheek en de graphql-ruby-bibliotheek die kunnen leiden tot ongeautoriseerde toegang en remote code execution. Deze kwetsbaarheden vereisen onmiddellijke aandacht van beveiligingsbeheerders.

Oplossingen
GitLab heeft patches en updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 9

  • Critical 9.3
    CVE-2025-25291 EPSS 21%

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 9.3
    CVE-2025-25292 EPSS 65%

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 9.1
    CVE-2025-27407 Public exploit

    Remote code execution when loading a crafted GraphQL schema

    graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema…

    rmosolgo graphql-ruby graphql ruby-graphql Debian Ubuntu RubyGems
  • Medium 6.5
    CVE-2024-13054

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-1257

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipul…

    GitLab GitLab Web / CMS
  • Medium 4.4
    CVE-2024-12380

    Generation of Error Message Containing Sensitive Information in GitLab

    An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potential…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-0652

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential informatio…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2024-8402

    Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature c…

    GitLab GitLab Web / CMS
  • Low 2.7
    CVE-2024-7296

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed use…

    GitLab GitLab Web / CMS

Revision history

  1. #1.0.0

    Initiele versie

References