PT-2025-30634 · Gitlab · Gitlab Ce/Ee

Published 2025-07-23 · Updated 2025-08-08 · CVE-2025-4976

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.0 through 18.0.4 GitLab EE versions 18.1 through 18.1.2 GitLab EE versions 18.2 through 18.2.0

Description An issue exists in GitLab EE that, under certain circumstances, could allow an attacker to access internal notes in GitLab Duo responses.

Recommendations Update to GitLab EE version 18.0.5 or later. Update to GitLab EE version 18.1.3 or later. Update to GitLab EE version 18.2.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-213

Related Identifiers

BDU:2025-09116

BIT-GITLAB-2025-4976

CVE-2025-4976

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4976.json · Exploit
• 🔥 https://hackerone.com/reports/3149956 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4976 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2025-4976 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09116 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-4976 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4976 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4976 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4976 · Vendor Advisory
• https://twitter.com/jmdevlabs/status/1953633916817903892 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/543905 · Note
• https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released · Note
• https://twitter.com/CVEnew/status/1948276024363401516 · Twitter Post