This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 5 vulnerabilities
GitLab fixes 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.10.4, 17.9.6 and 17.8.7 [1].
An authenticated remote attacker can carry out a DoS attack by working with oversized data [1].
The vulnerability is present in product:
- GitLab; <17.8.7; >=17.9, <17.9.6; >=17.10, <17.10.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-1677 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2025.
An authenticated remote attacker can use social engineering to gain unauthorized access to certain functionality [1].
The vulnerability is present in product:
- GitLab; >=7.7, <17.8.7; >=17.9, <17.9.6; >=17.10, <17.10.4;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2025-0362 at cve.org, NVD
- CWE-1021: Improper Restriction of Rendered UI Layers or Frames at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2025.
An unauthenticated remote attacker can bypass network security controls and thereby gain access to sensitive information [1].
The vulnerability is present in product:
- GitLab; >=13.12, <17.8.7; >=17.9, <17.9.6; >=17.10, <17.10.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-2408 at cve.org, NVD
- CWE-1220: Insufficient Granularity of Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2025.
An authenticated remote attacker can gain unauthorized access to information by using search [1].
The vulnerability is present in product:
- GitLab; >=17.1, <17.8.7; >=17.9, <17.9.6; >=17.10, <17.10.4;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-11129 at cve.org, NVD
- CWE-209: Generation of Error Message Containing Sensitive Information at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2025.
An unauthenticated remote attacker can gain unauthorized access to information about certain services [1].
The vulnerability is present in product:
- GitLab; >=17.9, <17.9.6; >=17.10, <17.10.4;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-2469 at cve.org, NVD
- CWE-1295: Debug Messages Revealing Unnecessary Information at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2025.
By CESNET, z.s.p.o. Martin Krajči on 11. 4. 2025.