Skip to content
OpenAdvisories
High WID-SEC-2025-0880 5 CVEs

GitLab: Mehrere Schwachstellen

Published Apr 23, 2025 · Updated Apr 23, 2025 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting durchzuführen, einen Denial of Service auszulösen oder Benutzerrechte zu erlangen

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 5

  • High 8.7
    CVE-2025-1763

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.1…

    GitLab GitLab Web / CMS
  • High 8.7
    CVE-2025-2443

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.1…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.7
    CVE-2025-1908

    Business Logic Errors in GitLab

    An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-0639

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-12244

    Missing Authorization in GitLab

    An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References