Skip to content
OpenAdvisories
Medium NCSC-2025-0306 4 CVEs

Kwetsbaarheden verholpen in GitLab

Published Oct 13, 2025 · Updated Oct 13, 2025 · nl

Vendor: GitLab Product: Community Edition, Enterprise Edition Product: Enterprise Edition Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab CE/EE versies 13.12 tot 18.2.8, 18.3 tot 18.3.4, en 18.4 tot 18.4.2.

Details

Interpretaties
De kwetsbaarheden omvatten een probleem waarbij speciaal samengestelde GraphQL-queries grote repository-blobs onresponsief kunnen maken, en een fout die geauthenticeerde gebruikers met alleen-lezen API-tokens in staat stelde om ongeautoriseerde schrijfoperaties uit te voeren op kwetsbaarheidsrecords. Daarnaast konden geauthenticeerde aanvallers kwaadaardige webhook-eindpunten configureren, wat kon leiden tot een Denial-of-Service.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 4

  • High 7.7
    CVE-2025-11340

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability r…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-10004

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.0
    CVE-2025-9825

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying t…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-2934

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious w…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/