This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 3 vulnerabilities
GitLab fixes 3 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.11.2, 17.10.6 and 17.9.8 [1].
An unauthenticated remote attacker can, under certain conditions, bypass the Device OAuth protection and gain unauthorized access to data and functions intended for another user.[1].
The vulnerability is present in product:
- GitLab; >=17.3, <17.9.8; >=17.10, <17.10.6; >=17.11, <17.11.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2025-0549 at cve.org, NVD
- CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org
The vulnerability was publicly disclosed 7. 5. 2025.
An authenticated remote attacker can carry out a DoS attack by sending specially crafted import requests [1].
The vulnerability is present in product:
- GitLab; >=17.1, <17.9.8; >=17.10, <17.10.6; >=17.11, <17.11.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-8973 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 7. 5. 2025.
An unauthenticated remote attacker can bypass IP address restrictions and thereby gain access to potentially sensitive information [1].
The vulnerability is present in product:
- GitLab; >=12.0, <17.9.8; >=17.10, <17.10.6; >=17.11, <17.11.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-1278 at cve.org, NVD
- CWE-1220: Insufficient Granularity of Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 7. 5. 2025.
By CESNET, z.s.p.o. Martin Krajči on 12. 5. 2025.