GitLab CE and EE fix 8 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] GitLab CE and EE fix 8 vulnerabilities

GitLab versions 17.8.2, 17.7.4 and 17.6.5 fix 8 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) [1].

GitLab - XSS (CVE-2025-0376)

CVSS 8.7 (High)

An authenticated remote attacker can carry out an XSS attack in GitLab CE/EE [1].

The vulnerability is present in products:

*:GitLab Community Edition; >=13.3, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2
*:GitLab Enterprise Edition; >=13.3, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

CVE-2025-0376 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - denial of service (CVE-2024-12379)

CVSS 6.5 (Medium)

Due to unlimited symbol creation via the scopes parameter in a personal access token, an authenticated remote attacker can carry out a DoS attack in GitLab CE/EE [1].

The vulnerability is present in products:

*:GitLab Community Edition; >=14.1, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2
*:GitLab Enterprise Edition; >=14.1, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

CVE-2024-12379 at cve.org, NVD
CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - private content access (CVE-2024-3303)

CVSS 6.4 (Medium)

An authenticated remote attacker can gain access to private content in GitLab EE using a spoofed command [1].

The vulnerability is present in product:

*:GitLab Enterprise Edition; >=16.0, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

More information:

CVE-2024-3303 at cve.org, NVD
CWE-1427: Improper Neutralization of Input Used for LLM Prompting at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - repository settings override (CVE-2025-1042)

CVSS 2.7 (Low)

An authenticated remote attacker can view repository contents in GitLab EE even without the appropriate permissions [1].

The vulnerability is present in product:

*:GitLab Enterprise Edition; >=15.7, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2025-1042 at cve.org, NVD
CWE-552: Files or Directories Accessible to External Parties at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - information disclosure (CVE-2025-1212)

CVSS 4.3 (Medium)

An authenticated remote attacker can send a modified request to the backend server in GitLab CE/EE and thereby disclose sensitive information [1].

The vulnerability is present in products:

*:GitLab Community Edition; >=8.3, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2
*:GitLab Enterprise Edition; >=8.3, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2025-1212 at cve.org, NVD
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - SSRF (CVE-2024-9870)

CVSS 4.3 (Medium)

An authenticated remote attacker can carry out an SSRF attack in GitLab EE by sending specially crafted requests [1].

The vulnerability is present in products:

*:GitLab Community Edition; >=8.3, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2
GitLab Enterprise Edition; >=8.3, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2024-9870 at cve.org, NVD
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - improper authorization (CVE-2025-0516)

CVSS 4.3 (Medium)

An authenticated remote attacker can perform unauthorized actions on critical project data in GitLab CE/EE [1].

The vulnerability is present in products:

*:GitLab Community Edition; >=17.7, <17.7.4; >=17.8, <17.8.2
*:GitLab Enterprise Edition; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

More information:

CVE-2025-0516 at cve.org, NVD
CWE-863: Incorrect Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

GitLab - insufficient session expiration (CVE-2025-1198)

CVSS 4.2 (Medium)

An authenticated remote attacker can gain access to streaming results in ActionCable in GitLab CE/EE using long-lived connections, which potentially allowed access even after personal access tokens had been revoked [1].

The vulnerability is present in products:

*:GitLab Community Edition; >=16.11, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2
*:GitLab Enterprise Edition; >=16.11, <17.6.5; >=17.7, <17.7.4; >=17.8, <17.8.2

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

CVE-2025-1198 at cve.org, NVD
CWE-613: Insufficient Session Expiration at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2025.

Report feedback

[TLP:CLEAR] GitLab CE and EE fix 8 vulnerabilities

GitLab - XSS (CVE-2025-0376)

CVSS 8.7 (High)

GitLab - denial of service (CVE-2024-12379)

CVSS 6.5 (Medium)

GitLab - private content access (CVE-2024-3303)

CVSS 6.4 (Medium)

GitLab - repository settings override (CVE-2025-1042)

CVSS 2.7 (Low)

GitLab - information disclosure (CVE-2025-1212)

CVSS 4.3 (Medium)

GitLab - SSRF (CVE-2024-9870)

CVSS 4.3 (Medium)

GitLab - improper authorization (CVE-2025-0516)

CVSS 4.3 (Medium)

GitLab - insufficient session expiration (CVE-2025-1198)

CVSS 4.2 (Medium)

Links