Skip to content
OpenAdvisories
High NCSC-2025-0100 6 CVEs

Kwetsbaarheden verholpen in GitLab EE/CE

Published Mar 27, 2025 · Updated Mar 27, 2025 · nl

Vendor: GitLab Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab EE/CE (Specifiek voor versies van 13.5.0 tot 17.10.1).

Details

Interpretaties
De kwetsbaarheden omvatten een invoervalidatiefout die het mogelijk maakt voor gebruikers om kwaadaardige code in CLI-opdrachten te injecteren, een cross-site scripting kwetsbaarheid die het mogelijk maakt voor kwaadwillenden om willekeurige scripts uit te voeren in de context van een gebruikerssessie, en een onjuist toegangscontroleprobleem dat downgraded instance beheerders in staat stelt om verhoogde privileges te behouden. Deze kwetsbaarheden kunnen leiden tot ongeautoriseerde toegang en de integriteit van systemen en gebruikersrechten ondermijnen.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • High 8.7
    CVE-2025-0811

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.7
    CVE-2025-2255

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-2242

    Incorrect Authorization in GitLab

    An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to conti…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.2
    CVE-2024-12619

    Insufficient Granularity of Access Control in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-10307

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2024-9773

    Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could ha…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1.0.0

    Initiele versie

References