Report feedback

An authenticated remote attacker can carry out an XSS attack, which allows them to impersonate another user [1].

The vulnerability is present in product:

• GitLab; >=18.0, <18.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

• CVE-2025-4278 at cve.org, NVD
• CVE-2025-2254 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.

An authenticated attacker can make unauthorized use of CI/CD-related functionality in GitLab EE [1].

The vulnerability is present in product:

• GitLab EE; >=17.11, <17.11.4; >=18.0, <18.0.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2025-5121 at cve.org, NVD
• CWE-862: Missing Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.

An unauthenticated remote attacker can carry out a DoS attack on the affected GitLab server [1]

The vulnerability is present in product:

• GitLab; >=17.7, <17.10.8; >=17.11, <17.11.4; >=18.0, <18.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-0673 at cve.org, NVD
• CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.

An authenticated remote attacker can, under certain circumstances, access private repositories [1].

The vulnerability is present in product:

• GitLab; <17.10.8; >=17.11, <17.11.4; >=18.0, <18.0.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

• CVE-2024-9512 at cve.org, NVD
• CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.