PT-2025-12999 · Gitlab · Gitlab Ce/Ee

CVE-2025-0811 · Publicado 2025-03-26 · Atualizado 2025-08-13

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.7 through 17.8.6 GitLab CE/EE versions 17.9 through 17.9.3 GitLab CE/EE versions 17.10 through 17.10.1

Description An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

Recommendations Update to version 17.8.6 to patch the vulnerability for versions 17.7 through 17.8.6. Update to version 17.9.3 to patch the vulnerability for versions 17.9 through 17.9.3. Update to version 17.10.1 to patch the vulnerability for versions 17.10 through 17.10.1.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2025-03518

BIT-GITLAB-2025-0811

CVE-2025-0811

Produtos afetados

Gitlab Ce/Ee

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0811.json · Exploit
• 🔥 https://hackerone.com/reports/2961854 · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/515566 · Exploit
• https://osv.dev/vulnerability/CVE-2025-0811 · Aviso do Fabricante
• https://t.me/cvenotify/116495 · Publicação no Telegram
• https://twitter.com/the_yellow_fall/status/1904896774680306047 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1905243885867053112 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-0811 · Nota de Segurança
• https://t.me/cveNotify/131983 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2025-0811 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-03518 · Nota de Segurança
• https://t.me/cvedetector/21275 · Publicação no Telegram
• https://reddit.com/r/secops_solution/comments/1kwst3h/top_ubuntu_security_patches_you_shouldnt_ignore · Publicação no Reddit
• https://twitter.com/CVEnew/status/1905300669004910870 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0811 · Aviso do Fabricante