SB2025042341 - Multiple vulnerabilities in GitLab
Published: April 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Stored cross-site scripting (CVE-ID: CVE-2025-1763)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Maven Dependency Proxy. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Stored cross-site scripting (CVE-ID: CVE-2025-2443)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Maven Dependency Proxy. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Improper Neutralization of HTTP Headers for Scripting Syntax (CVE-ID: CVE-2025-1908)
The vulnerability allows a remote user to perform spoofing attack.
The vulnerability exists due to improper input validation when processing Network Error Logging (NEL) HTTP headers in Maven dependency proxy. A remote user can inject a Network Error Logging (NEL) HTTP header into server response and potentially take over an arbitrary account.
4) Resource exhaustion (CVE-ID: CVE-2025-0639)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Improper access control (CVE-ID: CVE-2024-12244)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and view certain restricted project information.
Remediation
Install update from vendor's website.