Skip to content
OpenAdvisories
High WID-SEC-2025-0449 6 CVEs

GitLab: Mehrere Schwachstellen

Published Feb 26, 2025 · Updated Mar 6, 2025 · Revision 2 · de-DE

Summary

Ein entfernter authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen und vertrauliche Informationen preiszugeben. Skripting-Angriff.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 6

  • High 8.7
    CVE-2025-0475

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.

    GitLab GitLab Web / CMS
  • High 7.7
    CVE-2025-0555

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under spec…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2024-8186

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2024-10925

    Authorization Bypass Through User-Controlled Key in GitLab

    A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2025-2045

    Incorrect Authorization in GitLab

    Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access to potentially sensitive project analytics data.

    GitLab GitLab Web / CMS
  • Unscored —
    CVE-2025-0307 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Revision history

  1. #2

    CVE ergänzt

  2. #1

    Initiale Fassung

References