Report feedback

An authenticated remote attacker can carry out an XSS attack [1].

The vulnerability is present in product:

• GitLab; >=16.6, <17.9.7; >=17.10, <17.10.5; >=17.11, <17.11.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

• CVE-2025-1763 at cve.org, NVD
• CVE-2025-2443 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 23. 4. 2025.

An authenticated remote attacker can monitor the victim's web browsing in a limited way, which may potentially lead to account takeover [1].

The vulnerability is present in product:

• GitLab; >=16.6, <17.9.7; >=17.10, <17.10.5; >=17.11, <17.11.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

• CVE-2025-1908 at cve.org, NVD
• CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax at cwe.mitre.org

The vulnerability was publicly disclosed 23. 4. 2025.

An authenticated remote attacker can carry out a DoS attack [1].

The vulnerability is present in product:

• GitLab; >=16.7, <17.9.7; >=17.10, <17.10.5; >=17.11, <17.11.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-0639 at cve.org, NVD
• CWE-400: Resource exhaustion at cwe.mitre.org

The vulnerability was publicly disclosed 23. 4. 2025.

An authenticated remote attacker can gain unauthorized access to information with restricted access [1].

The vulnerability is present in product:

• GitLab; >=17.7, <17.9.7; >=17.10, <17.10.5; >=17.11, <17.11.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

• CVE-2024-12244 at cve.org, NVD
• CWE-284: Improper Access Control at cwe.mitre.org

The vulnerability was publicly disclosed 23. 4. 2025.