PT-2025-11152 · Gitlab · Gitlab Ce/Ee

Published 2025-03-12 · Updated 2025-08-08 · CVE-2025-0652

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.9 through 17.7.7 GitLab EE/CE versions 17.8 through 17.8.5 GitLab EE/CE versions 17.9 through 17.9.2

Description: The issue could allow unauthorized users to access confidential information intended for internal use only. This affects GitLab EE/CE and could potentially expose sensitive data.

Recommendations: For versions 16.9 through 17.7.7, update to version 17.7.7 or later. For versions 17.8 through 17.8.5, update to version 17.8.5 or later. For versions 17.9 through 17.9.2, update to version 17.9.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-03643

BIT-GITLAB-2025-0652

CVE-2025-0652

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0652.json · Exploit
• 🔥 https://hackerone.com/reports/2947863 · Exploit
• https://ubuntu.com/security/CVE-2025-0652 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-0652 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-0652 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0652 · Security Note
• https://bdu.fstec.ru/vul/2025-03643 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0652 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0652 · Vendor Advisory
• https://t.me/cveNotify/131358 · Telegram Post
• https://t.me/cvedetector/20193 · Telegram Post
• https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/514532 · Note
• https://twitter.com/CVEnew/status/1900082988831949262 · Twitter Post