Vulnerabilities fixed in GitLab

🗓️ 14 Mar 2025 09:14:59Reported by NCSCType

GitLab fixed 11.5–17.9.2 vulnerabilities including permission abuse, IAM code injection, auth data exposure, DoS, and RCE in ruby saml and graphql ruby; patches issued.

Reporter	Title	Published	Views	Family All 194
FreeBSD	Gitlab -- Vulnerabilities	12 Mar 202500:00	–	freebsd
BDU FSTEC	The vulnerability in the implementation of the SAML SSO protocol for the Ruby SAML library and the git-based software platform for collaborative code development on GitLab CE/EE allows a perpetrator to bypass authentication.	17 Mar 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SAML SSO library in Ruby SAML and the Git-based software platform for collaborative code development on GitLab CE/EE allows a perpetrator to bypass authentication.	17 Mar 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the GraphQL library for Ruby and the git-based software platform for collaborative code development on GitLab CE/EE arises from improper code generation management. This vulnerability allows a perpetrator to execute arbitrary code.	17 Mar 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE lies in the shortcomings of the error reporting mechanism, which allows attackers to disclose protected information.	18 Mar 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to the lack of measures taken to clean up data at the management level, allows a perpetrator to introduce arbitrary code.	18 Mar 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE arises from deficiencies in the authentication mechanism, allowing unauthorized access to protected information.	1 Apr 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to unlimited resource distribution, allows a hacker to trigger a service failure.	1 Apr 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to deficiencies in the authentication mechanism, allows a malicious actor to influence the integrity of the protected information.	1 Apr 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to unlimited resource distribution, allows a hacker to cause a service failure.	1 Apr 202500:00	–	bdu_fstec

Vulners

Node

gitlab gitlabRange<17.7.7

gitlab gitlabRange17.9–17.9.2

gitlab gitlabRange17.8–17.8.5

gitlab gitlabRange17.2–17.7.7

gitlab gitlabRange16.9–17.7.7

gitlab gitlabRange16.5–17.7.7

gitlab gitlabRange12.3–17.7.7

gitlab gitlabRange11.5–17.7.7

Source	Link
about	www.about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/

14 Mar 2025 09:14Current

9.8High risk

Vulners AI Score9.8

CVSS 49.3

CVSS 3.19 - 9.8

EPSS0.20843

SSVC