PT-2025-9912 · Gitlab · Gitlab Ce/Ee

Renato Alves · Publicado 2025-01-11 · Atualizado 2025-03-10 · CVE-2025-1540

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.5 through 17.6.4 GitLab CE/EE versions 17.7 through 17.7.3 GitLab CE/EE versions 17.8 through 17.8.1

Description An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances. It was possible for a user added as an External to read and clone internal projects under certain circumstances.

Recommendations For versions 17.5 through 17.6.4, update to version 17.6.5 or later. For versions 17.7 through 17.7.3, update to version 17.7.4 or later. For versions 17.8 through 17.8.1, update to version 17.8.2 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2025-02449

BIT-GITLAB-2025-1540

CVE-2025-1540

Produtos afetados

Gitlab Ce/Ee

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1540.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/512765 · Exploit
• https://ubuntu.com/security/CVE-2025-1540 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-1540 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-gitlab-2025-1540 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2025-1540 · Nota de Segurança
• https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/#saml-authentication-misconfigures-external-user-attribute · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1540 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-1540 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1897912313002557662 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-02449 · Nota de Segurança
• https://twitter.com/NightShift215/status/1899171531139301727 · Publicação no Twitter