Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: GitLab 17.6.5, 17.7.4, 17.8.2 Clear all filters
TI-2024-09158 CVE-2024-9870 · GHSA-22qj-f25c-22mc

Unintended Proxy or Intermediary ('Confused Deputy') in GitLab

Priority LOW 38

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to u…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00393 Published 2025-02-12 Fixed in 17.6.5, 17.7.4 +1 CWE-441
TI-2024-11484 CVE-2024-12379 · GHSA-v488-9cvj-5mx7

Allocation of Resources Without Limits or Throttling in GitLab

Priority LOW 29

A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded sym…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00508 Published 2025-02-12 Fixed in 17.6.5, 17.7.4 +1 CWE-770
TI-2025-00307 CVE-2025-0376 · GHSA-8rmw-8cch-2w5c

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Priority MEDIUM 40

An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00394 Published 2025-02-12 Fixed in 17.6.5, 17.7.4 +1 CWE-79
TI-2025-01036 CVE-2025-1212 · GHSA-68hg-5q58-g3cv

Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

Priority LOW 33

An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00402 Published 2025-02-12 Fixed in 17.6.5, 17.7.4 +1 CWE-497
TI-2025-00881 CVE-2025-1042 · GHSA-f73r-7g7h-494m

Files or Directories Accessible to External Parties in GitLab

Priority LOW 33

An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized w…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2025-02-12 Fixed in 17.6.5, 17.7.4 +1 CWE-552