Skip to content
OpenAdvisories
High NCSC-2025-0288 6 CVEs

Kwetsbaarheden verholpen in GitLab CE/EE

Published Sep 12, 2025 · Updated Sep 12, 2025 · nl

Vendor: GitLab Product: Community Edition, Enterprise Edition Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab CE/EE (Versies voor 18.1.6, 18.2.6, en 18.3.2).

Details

Interpretaties
De kwetsbaarheden in de getroffen versies stellen geauthenticeerde gebruikers in staat om tokenbeheer te manipuleren, achtergrondtaken te verstoren, meerdere grote SAML-antwoorden te verzenden, proxy-omgevingen te manipuleren, toegang te krijgen tot onderhoudsnotities die alleen voor beheerders zijn, en om excessief grote bestanden te uploaden. Dit kan leiden tot operationele inefficiënties, verstoring van de beschikbaarheid van het platform, ongeoorloofde blootstelling van gevoelige informatie en zelfs een aanhoudende denial-of-service. Beheerders moeten bijzonder waakzaam zijn voor ongebruikelijke activiteiten en ervoor zorgen dat de toegang tot gevoelige informatie goed wordt beheerd.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • High 8.5
    CVE-2025-6454

    Server-Side Request Forgery (SSRF) in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting c…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2025-2256

    Improper Validation of Specified Quantity in Input in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multip…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-10094

    Improper Validation of Specified Quantity in Input in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to disrupt access to token listings and related administrative operations by cr…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-1250

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messag…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-7337

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting …

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2025-6769

    Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details throug…

    GitLab GitLab Web / CMS

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/