Skip to content
OpenAdvisories
Medium WID-SEC-2025-0778 5 CVEs

GitLab: Mehrere Schwachstellen

Published Apr 9, 2025 · Updated Apr 9, 2025 · de-DE

Summary

Ein anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Informationen preiszugeben, einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 5

  • Medium 6.5
    CVE-2025-1677

    Allocation of Resources Without Limits or Throttling in GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.4
    CVE-2025-0362

    Improper Restriction of Rendered UI Layers or Frames in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.3
    CVE-2024-11129

    Generation of Error Message Containing Sensitive Information in GitLab

    An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the search…

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2025-2408

    Insufficient Granularity of Access Control in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2025-2469

    Debug Messages Revealing Unnecessary Information in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users.

    GitLab GitLab Web / CMS

Revision history

  1. #1

    Initiale Fassung

References