CVE-2025-1212
Published: 12 February 2025
Description
An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.
Security Summary
CVE-2025-1212 is an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. The issue enables an attacker to send a crafted request to a backend server, resulting in the exposure of sensitive information. It is associated with CWE-497 and carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
The vulnerability can be exploited by a low-privileged authenticated user over the network with low attack complexity and no requirement for user interaction. Successful exploitation achieves a low-impact disclosure of confidential information without impacting integrity or availability.
Mitigation is available by upgrading to GitLab 17.6.5, 17.7.4, 17.8.2, or later versions. Further details on the issue and resolution are provided in the GitLab security advisory at https://gitlab.com/gitlab-org/gitlab/-/issues/502196.
Details
- CWE(s)