PT-2025-3767 · Gitlab · Gitlab Ce/Ee

Hakeem Abdul-Razak · Published 2025-01-08 · Updated 2025-01-10 · CVE-2025-0194

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.4 through 17.5.5 GitLab CE/EE versions 17.6 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.1

Description An issue was discovered in GitLab CE/EE where access tokens may have been logged when API requests were made in a specific manner under certain conditions.

Recommendations For versions 17.4 through 17.5.5, update to version 17.5.5 or later. For versions 17.6 through 17.6.3, update to version 17.6.3 or later. For versions 17.7 through 17.7.1, update to version 17.7.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-538

Related Identifiers

BDU:2025-03140

BIT-GITLAB-2025-0194

CVE-2025-0194

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0194.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-0194 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-0194 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0194 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/489459 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03140 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-0194 · Security Note
• https://ubuntu.com/security/CVE-2025-0194 · Vendor Advisory
• https://twitter.com/CVEnew/status/1877090755933503989 · Twitter Post
• https://t.me/cvenotify/106882 · Telegram Post
• https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#possible-access-token-exposure-in-gitlab-logs · Note
• https://t.me/cvedetector/14731 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1877146480944832985 · Twitter Post