Skip to content
OpenAdvisories
High WID-SEC-2025-1627 6 CVEs

GitLab: Mehrere Schwachstellen

Published Jul 22, 2025 · Updated Jul 24, 2025 · Revision 3 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und um Informationen offenzulegen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 6

  • High 8.7
    CVE-2025-4700

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content ren…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.7
    CVE-2025-4439

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-0765

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an unauthorized user to access custom service desk email addresses.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-1299

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized us…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-4976

    Exposure of Sensitive Information Due to Incompatible Policies in GitLab

    An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-7001

    Insufficient Granularity of Access Control in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed priviledged users to access certain resource_group information through the API which should have be…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2025-22482

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-22466

  3. #1

    Initiale Fassung

References