Skip to content
OpenAdvisories
Medium WID-SEC-2025-1394 5 CVEs

GitLab: Mehrere Schwachstellen

Published Jun 24, 2025 · Updated Jun 24, 2025 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsvorkehrungen zu umgehen, seine Rechte zu erweitern oder einen Denial of Service zu verursachen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 5

  • Medium 6.5
    CVE-2025-3279

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2025-1754

    Missing Authentication for Critical Function in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requ…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-5315

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sendi…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2025-2938

    Business Logic Errors in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where rol…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.7
    CVE-2025-5846

    Missing Authorization in GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References