GitLab CE and EE fix 4 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitLab CE and EE fix 4 vulnerabilities

GitLab versions 17.7.1, 17.6.3 and 17.5.5 fix 4 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) [1].

GitLab - access token leak (CVE-2025-0194)

CVSS 6.5 (Medium)

Potentially allows an authenticated remote attacker with access to logs to view access tokens [1].

The vulnerability is present in product:

GitLab; >=17.4, <17.5.5; >=17.6, <17.6.3; >=17.7, <17.7.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

CVE-2025-0194 at cve.org, NVD
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

GitLab - DoS (CVE-2024-6324)

CVSS 4.3 (Medium)

Allows an authenticated remote attacker to perform a DoS attack [1].

The vulnerability is present in product:

GitLab; >=15.7, <17.5.5; >=17.6, <17.6.3; >=17.7, <17.7.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

More information:

CVE-2024-6324 at cve.org, NVD
CWE-407: Inefficient Algorithmic Complexity at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

GitLab - unauthorized change (CVE-2024-12431)

CVSS 4.3 (Medium)

Allows an authenticated remote attacker to change the status of reported issues in public projects without authorization [1].

The vulnerability is present in product:

GitLab; >=16.4, <17.5.5; >=17.6, <17.6.3; >=17.7, <17.7.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

More information:

CVE-2024-12431 at cve.org, NVD
CWE-862: Missing Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

GitLab - unauthorized access (CVE-2024-13041)

CVSS 4.2 (Medium)

Allows an authenticated remote attacker with external user privileges, under certain circumstances, to gain unauthorized access to internal projects [1].

The vulnerability is present in product:

GitLab; >=16.4, <17.5.5; >=17.6, <17.6.3; >=17.7, <17.7.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

CVE-2024-13041 at cve.org, NVD
CWE-286: Incorrect User Management at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

Report feedback

[TLP:CLEAR] GitLab CE and EE fix 4 vulnerabilities

GitLab - access token leak (CVE-2025-0194)

CVSS 6.5 (Medium)

GitLab - DoS (CVE-2024-6324)

CVSS 4.3 (Medium)

GitLab - unauthorized change (CVE-2024-12431)

CVSS 4.3 (Medium)

GitLab - unauthorized access (CVE-2024-13041)

CVSS 4.2 (Medium)

Links