Skip to content
OpenAdvisories
High WID-SEC-2025-0171 3 CVEs

GitLab: Mehrere Schwachstellen

Published Jan 22, 2025 · Updated Jan 22, 2025 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Informationen preiszugeben, einen Denial-of-Service-Zustand zu erzeugen und einen Cross-Site-Scripting-Angriff zu starten.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 3

  • High 8.7
    CVE-2025-0314

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.4
    CVE-2024-11931

    Insufficient Granularity of Access Control in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate p…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-6324

    Inefficient Algorithmic Complexity in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics.

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References