PT-2025-47047 · Gitlab · Gitlab Ce/Ee

CVE-2025-11865 · Publicado 2025-11-12 · Atualizado 2025-11-15

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.1 through 18.3.6 GitLab EE versions 18.4 through 18.4.4 GitLab EE versions 18.5 through 18.5.2

Description A security issue exists in GitLab EE that, under specific conditions, could allow an attacker to remove Duo multi-factor authentication flows belonging to another user.

Recommendations Update GitLab EE to version 18.3.6 or later. Update GitLab EE to version 18.4.4 or later. Update GitLab EE to version 18.5.2 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2025-14458

BIT-GITLAB-2025-11865

CVE-2025-11865

Produtos afetados

Gitlab Ce/Ee

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11865.json · Exploit
• https://twitter.com/VulmonFeeds/status/1989624710913516020 · Publicação no Twitter
• https://t.me/cveNotify/142911 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-11865 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1989608990737862882 · Publicação no Twitter
• https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-11865 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-14458 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11865 · Nota
• https://t.me/CVEtracker/37415 · Publicação no Telegram
• https://gitlab.com/gitlab-org/gitlab/-/issues/561399 · Nota