This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 4 vulnerabilities
GitLab fixes 4 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.3.1, 18.2.5 and 18.1.5.
Due to insufficient limiting of response size when processing specified URLs, an authenticated remote attacker can carry out a DoS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=8.15, <18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
- GitLab Enterprise Edition; >=8.15, <18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-3601 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 27. 8. 2025.
Due to an insufficient permission check in the GraphQL API, an unauthenticated remote attacker can gain unauthorized access to sensitive manual CI/CD variables [1].
The vulnerability is present in products:
- GitLab Community Edition; >=14.1, <18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
- GitLab Enterprise Edition; >=14.1, <18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
More information:
- CVE-2025-2246 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 27. 8. 2025.
By sending specially crafted GraphQL requests, an unauthenticated remote attacker can carry out a DoS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=14.1, <18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
- GitLab Enterprise Edition; >=14.1, <18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2025-4225 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 27. 8. 2025.
By abusing the ambiguity between branches and tags during repository import, an authenticated local attacker can distribute malicious code [1].
The vulnerability is present in products:
- GitLab Community Edition; >18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
- GitLab Enterprise Edition; >18.1.5; >=18.2, <18.2.5; >=18.3, <18.3.1
CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
More information:
- CVE-2025-5101 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 27. 8. 2025.
By CESNET, z.s.p.o. Michaela Jarošová on 1. 9. 2025.