Vulnerability

CERT-In Vulnerability Note CIVN-2025-0062
Multiple Vulnerabilities in GitLab

Original Issue Date:April 02, 2025

Severity Rating: CRITICAL

Software Affected

Gitlab versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1 for Community Edition (CE) and Enterprise Edition (EE)

Overview

Multiple vulnerabilities have been reported in GitLab which could allow an attacker to cause cross-site scripting, privilege escalation and disclosing sensitive information on the targeted system.

Target Audience:
All organizations and individuals using Gitlab.

Impact Assessment:
Potential for cross-site scripting (XSS) attacks, escalate privileges and disclosing sensitive information.

Description

Multiple vulnerabilities exist in GitLab Community Edition (CE) and Enterprise Edition (EE), due to improper rendering of certain file types, input validation issue in the Harbor registry integration or specifically crafted issue/file. An attacker could exploit these vulnerabilities by executing crafted requests.

Successful exploitation of these vulnerabilities could allow the attacker to cause cross-site scripting, privilege escalation and disclosing sensitive information on the targeted system.

Solution

Apply appropriate software updates as mentioned in GitLab security advisories:
https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/

Vendor Information

https://about.gitlab.com/

References

https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/

CVE Name
CVE-2025-2255
CVE-2025-0811
CVE-2025-2242
CVE-2024-12619
CVE-2024-10307
CVE-2024-9773

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India