Skip to content
OpenAdvisories
High WID-SEC-2025-0643 6 CVEs

GitLab: Mehrere Schwachstellen

Published Mar 26, 2025 · Updated Mar 26, 2025 · de-DE

Summary

Ein entfernter authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, erhöhte Rechte zu erlangen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 6

  • High 8.7
    CVE-2025-0811

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.7
    CVE-2025-2255

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-2242

    Incorrect Authorization in GitLab

    An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to conti…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.2
    CVE-2024-12619

    Insufficient Granularity of Access Control in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-10307

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2024-9773

    Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could ha…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References