csaf_ncscnl - ncsc-2025-0087

Vulnerability from csaf_ncscnl

Published

2025-03-14 09:14

Modified

2025-03-14 09:14

Summary

Kwetsbaarheden verholpen in GitLab

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

GitLab heeft kwetsbaarheden verholpen in GitLab EE/CE versies van 11.5 tot 17.9.2.

Interpretaties

De kwetsbaarheden omvatten onder andere een probleem waarbij gebruikers met aangepaste rechten meer lidmaatschapsverzoeken kunnen goedkeuren dan waar ze recht op hebben, wat kan leiden tot ongeautoriseerde toegang tot beperkte gebieden binnen het platform. Daarnaast zijn er kwetsbaarheden in de Google Cloud IAM-integratiefunctie die kwaadwillenden in staat kunnen stellen om kwaadaardige code in het systeem in te voeren. Er zijn ook kwetsbaarheden die gevoelige authenticatie-informatie kunnen blootstellen en een denial-of-service kunnen veroorzaken door manipulatie van specifieke invoer. Bovendien zijn er kritieke kwetsbaarheden in de ruby-saml-bibliotheek en de graphql-ruby-bibliotheek die kunnen leiden tot ongeautoriseerde toegang en remote code execution. Deze kwetsbaarheden vereisen onmiddellijke aandacht van beveiligingsbeheerders.

Oplossingen

GitLab heeft patches en updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-473

PHP External Variable Modification

CWE-347

Improper Verification of Cryptographic Signature

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-436

Interpretation Conflict

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-863

Incorrect Authorization

CWE-209

Generation of Error Message Containing Sensitive Information

JSON

To clipboard

{
   document: {
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
         },
      },
      lang: "nl",
      notes: [
         {
            category: "legal_disclaimer",
            text: "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.",
         },
         {
            category: "description",
            text: "GitLab heeft kwetsbaarheden verholpen in GitLab EE/CE versies van 11.5 tot 17.9.2.",
            title: "Feiten",
         },
         {
            category: "description",
            text: "De kwetsbaarheden omvatten onder andere een probleem waarbij gebruikers met aangepaste rechten meer lidmaatschapsverzoeken kunnen goedkeuren dan waar ze recht op hebben, wat kan leiden tot ongeautoriseerde toegang tot beperkte gebieden binnen het platform. Daarnaast zijn er kwetsbaarheden in de Google Cloud IAM-integratiefunctie die kwaadwillenden in staat kunnen stellen om kwaadaardige code in het systeem in te voeren. Er zijn ook kwetsbaarheden die gevoelige authenticatie-informatie kunnen blootstellen en een denial-of-service kunnen veroorzaken door manipulatie van specifieke invoer. Bovendien zijn er kritieke kwetsbaarheden in de ruby-saml-bibliotheek en de graphql-ruby-bibliotheek die kunnen leiden tot ongeautoriseerde toegang en remote code execution. Deze kwetsbaarheden vereisen onmiddellijke aandacht van beveiligingsbeheerders.",
            title: "Interpretaties",
         },
         {
            category: "description",
            text: "GitLab heeft patches en updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
            title: "Oplossingen",
         },
         {
            category: "general",
            text: "medium",
            title: "Kans",
         },
         {
            category: "general",
            text: "high",
            title: "Schade",
         },
         {
            category: "general",
            text: "PHP External Variable Modification",
            title: "CWE-473",
         },
         {
            category: "general",
            text: "Improper Verification of Cryptographic Signature",
            title: "CWE-347",
         },
         {
            category: "general",
            text: "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
            title: "CWE-77",
         },
         {
            category: "general",
            text: "Improper Control of Generation of Code ('Code Injection')",
            title: "CWE-94",
         },
         {
            category: "general",
            text: "Interpretation Conflict",
            title: "CWE-436",
         },
         {
            category: "general",
            text: "Allocation of Resources Without Limits or Throttling",
            title: "CWE-770",
         },
         {
            category: "general",
            text: "Incorrect Authorization",
            title: "CWE-863",
         },
         {
            category: "general",
            text: "Generation of Error Message Containing Sensitive Information",
            title: "CWE-209",
         },
      ],
      publisher: {
         category: "coordinator",
         contact_details: "cert@ncsc.nl",
         name: "Nationaal Cyber Security Centrum",
         namespace: "https://www.ncsc.nl/",
      },
      references: [
         {
            category: "external",
            summary: "Reference - certbundde",
            url: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/",
         },
      ],
      title: "Kwetsbaarheden verholpen in GitLab",
      tracking: {
         current_release_date: "2025-03-14T09:14:59.775984Z",
         generator: {
            date: "2025-02-25T15:15:00Z",
            engine: {
               name: "V.A.",
               version: "1.0",
            },
         },
         id: "NCSC-2025-0087",
         initial_release_date: "2025-03-14T09:14:59.775984Z",
         revision_history: [
            {
               date: "2025-03-14T09:14:59.775984Z",
               number: "1.0.0",
               summary: "Initiele versie",
            },
         ],
         status: "final",
         version: "1.0.0",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.6",
                        product: {
                           name: "vers:unknown/17.7.6",
                           product_id: "CSAFPID-2476827",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.5",
                        product: {
                           name: "vers:unknown/17.7.5",
                           product_id: "CSAFPID-2423675",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.4",
                        product: {
                           name: "vers:unknown/17.7.4",
                           product_id: "CSAFPID-2423674",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.3",
                        product: {
                           name: "vers:unknown/17.7.3",
                           product_id: "CSAFPID-2059906",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.2",
                        product: {
                           name: "vers:unknown/17.7.2",
                           product_id: "CSAFPID-2059905",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.1",
                        product: {
                           name: "vers:unknown/17.7.1",
                           product_id: "CSAFPID-2059904",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.0",
                        product: {
                           name: "vers:unknown/17.7.0",
                           product_id: "CSAFPID-2059903",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.9.1",
                        product: {
                           name: "vers:unknown/17.9.1",
                           product_id: "CSAFPID-2476830",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.9.0",
                        product: {
                           name: "vers:unknown/17.9.0",
                           product_id: "CSAFPID-2476829",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.4",
                        product: {
                           name: "vers:unknown/17.8.4",
                           product_id: "CSAFPID-2476828",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.3",
                        product: {
                           name: "vers:unknown/17.8.3",
                           product_id: "CSAFPID-2423678",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.2",
                        product: {
                           name: "vers:unknown/17.8.2",
                           product_id: "CSAFPID-2423677",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.1",
                        product: {
                           name: "vers:unknown/17.8.1",
                           product_id: "CSAFPID-2059908",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.0",
                        product: {
                           name: "vers:unknown/17.8.0",
                           product_id: "CSAFPID-2059907",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "Enterprise Edition",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.9.1",
                        product: {
                           name: "vers:unknown/17.9.1",
                           product_id: "CSAFPID-2476824",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.9.0",
                        product: {
                           name: "vers:unknown/17.9.0",
                           product_id: "CSAFPID-2476823",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.4",
                        product: {
                           name: "vers:unknown/17.8.4",
                           product_id: "CSAFPID-2476822",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.3",
                        product: {
                           name: "vers:unknown/17.8.3",
                           product_id: "CSAFPID-2395420",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.2",
                        product: {
                           name: "vers:unknown/17.8.2",
                           product_id: "CSAFPID-2395419",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.1",
                        product: {
                           name: "vers:unknown/17.8.1",
                           product_id: "CSAFPID-2056775",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.8.0",
                        product: {
                           name: "vers:unknown/17.8.0",
                           product_id: "CSAFPID-2056774",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.6",
                        product: {
                           name: "vers:unknown/17.7.6",
                           product_id: "CSAFPID-2476821",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.5",
                        product: {
                           name: "vers:unknown/17.7.5",
                           product_id: "CSAFPID-2395418",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.4",
                        product: {
                           name: "vers:unknown/17.7.4",
                           product_id: "CSAFPID-2395417",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.3",
                        product: {
                           name: "vers:unknown/17.7.3",
                           product_id: "CSAFPID-2056773",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.2",
                        product: {
                           name: "vers:unknown/17.7.2",
                           product_id: "CSAFPID-1864576",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.1",
                        product: {
                           name: "vers:unknown/17.7.1",
                           product_id: "CSAFPID-1864575",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:unknown/17.7.0",
                        product: {
                           name: "vers:unknown/17.7.0",
                           product_id: "CSAFPID-1864574",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "Community Edition, Enterprise Edition",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "vers:semver/<17.7.7",
                        product: {
                           name: "vers:semver/<17.7.7",
                           product_id: "CSAFPID-2476763",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/17.9|<17.9.2",
                        product: {
                           name: "vers:semver/17.9|<17.9.2",
                           product_id: "CSAFPID-2476758",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/17.8|<17.8.5",
                        product: {
                           name: "vers:semver/17.8|<17.8.5",
                           product_id: "CSAFPID-2476757",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/17.2|<17.7.7",
                        product: {
                           name: "vers:semver/17.2|<17.7.7",
                           product_id: "CSAFPID-2476764",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/16.9|<17.7.7",
                        product: {
                           name: "vers:semver/16.9|<17.7.7",
                           product_id: "CSAFPID-2476766",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/16.5|<17.7.7",
                        product: {
                           name: "vers:semver/16.5|<17.7.7",
                           product_id: "CSAFPID-2476756",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/12.3|<17.7.7",
                        product: {
                           name: "vers:semver/12.3|<17.7.7",
                           product_id: "CSAFPID-2476759",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:semver/11.5|<17.7.7",
                        product: {
                           name: "vers:semver/11.5|<17.7.7",
                           product_id: "CSAFPID-2476762",
                           product_identification_helper: {
                              cpe: "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "GitLab",
               },
            ],
            category: "vendor",
            name: "GitLab",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-7296",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         notes: [
            {
               category: "other",
               text: "Incorrect Authorization",
               title: "CWE-863",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2024-7296",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-7296.json",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 2.7,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-2476827",
                  "CSAFPID-2423675",
                  "CSAFPID-2423674",
                  "CSAFPID-2059906",
                  "CSAFPID-2059905",
                  "CSAFPID-2059904",
                  "CSAFPID-2059903",
                  "CSAFPID-2476824",
                  "CSAFPID-2476823",
                  "CSAFPID-2476822",
                  "CSAFPID-2395420",
                  "CSAFPID-2395419",
                  "CSAFPID-2056775",
                  "CSAFPID-2056774",
                  "CSAFPID-2476821",
                  "CSAFPID-2395418",
                  "CSAFPID-2395417",
                  "CSAFPID-2056773",
                  "CSAFPID-1864576",
                  "CSAFPID-1864575",
                  "CSAFPID-2476763",
                  "CSAFPID-2476758",
                  "CSAFPID-2476757",
                  "CSAFPID-2476764",
                  "CSAFPID-2476766",
                  "CSAFPID-2476756",
                  "CSAFPID-2476759",
                  "CSAFPID-2476762",
                  "CSAFPID-2476830",
                  "CSAFPID-2476829",
                  "CSAFPID-2476828",
                  "CSAFPID-2423678",
                  "CSAFPID-2423677",
                  "CSAFPID-2059908",
                  "CSAFPID-2059907",
                  "CSAFPID-1864574",
               ],
            },
         ],
         title: "CVE-2024-7296",
      },
      {
         cve: "CVE-2024-8402",
         cwe: {
            id: "CWE-77",
            name: "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
         },
         notes: [
            {
               category: "other",
               text: "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
               title: "CWE-77",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2024-8402",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-8402.json",
            },
         ],
         title: "CVE-2024-8402",
      },
      {
         cve: "CVE-2024-12380",
         cwe: {
            id: "CWE-209",
            name: "Generation of Error Message Containing Sensitive Information",
         },
         notes: [
            {
               category: "other",
               text: "Generation of Error Message Containing Sensitive Information",
               title: "CWE-209",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2024-12380",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-12380.json",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-2476827",
                  "CSAFPID-2423675",
                  "CSAFPID-2423674",
                  "CSAFPID-2059906",
                  "CSAFPID-2059905",
                  "CSAFPID-2059904",
                  "CSAFPID-2059903",
                  "CSAFPID-2476824",
                  "CSAFPID-2476823",
                  "CSAFPID-2476822",
                  "CSAFPID-2395420",
                  "CSAFPID-2395419",
                  "CSAFPID-2056775",
                  "CSAFPID-2056774",
                  "CSAFPID-2476821",
                  "CSAFPID-2395418",
                  "CSAFPID-2395417",
                  "CSAFPID-2056773",
                  "CSAFPID-1864576",
                  "CSAFPID-1864575",
                  "CSAFPID-2476763",
                  "CSAFPID-2476758",
                  "CSAFPID-2476757",
                  "CSAFPID-2476764",
                  "CSAFPID-2476766",
                  "CSAFPID-2476756",
                  "CSAFPID-2476759",
                  "CSAFPID-2476762",
                  "CSAFPID-2476830",
                  "CSAFPID-2476829",
                  "CSAFPID-2476828",
                  "CSAFPID-2423678",
                  "CSAFPID-2423677",
                  "CSAFPID-2059908",
                  "CSAFPID-2059907",
                  "CSAFPID-1864574",
               ],
            },
         ],
         title: "CVE-2024-12380",
      },
      {
         cve: "CVE-2024-13054",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         notes: [
            {
               category: "other",
               text: "Allocation of Resources Without Limits or Throttling",
               title: "CWE-770",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2024-13054",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-13054.json",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-2476827",
                  "CSAFPID-2423675",
                  "CSAFPID-2423674",
                  "CSAFPID-2059906",
                  "CSAFPID-2059905",
                  "CSAFPID-2059904",
                  "CSAFPID-2059903",
                  "CSAFPID-2476824",
                  "CSAFPID-2476823",
                  "CSAFPID-2476822",
                  "CSAFPID-2395420",
                  "CSAFPID-2395419",
                  "CSAFPID-2056775",
                  "CSAFPID-2056774",
                  "CSAFPID-2476821",
                  "CSAFPID-2395418",
                  "CSAFPID-2395417",
                  "CSAFPID-2056773",
                  "CSAFPID-1864576",
                  "CSAFPID-1864575",
                  "CSAFPID-2476763",
                  "CSAFPID-2476758",
                  "CSAFPID-2476757",
                  "CSAFPID-2476764",
                  "CSAFPID-2476766",
                  "CSAFPID-2476756",
                  "CSAFPID-2476759",
                  "CSAFPID-2476762",
                  "CSAFPID-2476830",
                  "CSAFPID-2476829",
                  "CSAFPID-2476828",
                  "CSAFPID-2423678",
                  "CSAFPID-2423677",
                  "CSAFPID-2059908",
                  "CSAFPID-2059907",
                  "CSAFPID-1864574",
               ],
            },
         ],
         title: "CVE-2024-13054",
      },
      {
         cve: "CVE-2025-0652",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         notes: [
            {
               category: "other",
               text: "Incorrect Authorization",
               title: "CWE-863",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2025-0652",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-0652.json",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-2476827",
                  "CSAFPID-2423675",
                  "CSAFPID-2423674",
                  "CSAFPID-2059906",
                  "CSAFPID-2059905",
                  "CSAFPID-2059904",
                  "CSAFPID-2059903",
                  "CSAFPID-2476824",
                  "CSAFPID-2476823",
                  "CSAFPID-2476822",
                  "CSAFPID-2395420",
                  "CSAFPID-2395419",
                  "CSAFPID-2056775",
                  "CSAFPID-2056774",
                  "CSAFPID-2476821",
                  "CSAFPID-2395418",
                  "CSAFPID-2395417",
                  "CSAFPID-2056773",
                  "CSAFPID-1864576",
                  "CSAFPID-1864575",
                  "CSAFPID-2476763",
                  "CSAFPID-2476758",
                  "CSAFPID-2476757",
                  "CSAFPID-2476764",
                  "CSAFPID-2476766",
                  "CSAFPID-2476756",
                  "CSAFPID-2476759",
                  "CSAFPID-2476762",
                  "CSAFPID-2476830",
                  "CSAFPID-2476829",
                  "CSAFPID-2476828",
                  "CSAFPID-2423678",
                  "CSAFPID-2423677",
                  "CSAFPID-2059908",
                  "CSAFPID-2059907",
                  "CSAFPID-1864574",
               ],
            },
         ],
         title: "CVE-2025-0652",
      },
      {
         cve: "CVE-2025-1257",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         notes: [
            {
               category: "other",
               text: "Allocation of Resources Without Limits or Throttling",
               title: "CWE-770",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2025-1257",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-1257.json",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-2476827",
                  "CSAFPID-2423675",
                  "CSAFPID-2423674",
                  "CSAFPID-2059906",
                  "CSAFPID-2059905",
                  "CSAFPID-2059904",
                  "CSAFPID-2059903",
                  "CSAFPID-2476824",
                  "CSAFPID-2476823",
                  "CSAFPID-2476822",
                  "CSAFPID-2395420",
                  "CSAFPID-2395419",
                  "CSAFPID-2056775",
                  "CSAFPID-2056774",
                  "CSAFPID-2476821",
                  "CSAFPID-2395418",
                  "CSAFPID-2395417",
                  "CSAFPID-2056773",
                  "CSAFPID-1864576",
                  "CSAFPID-1864575",
                  "CSAFPID-2476763",
                  "CSAFPID-2476758",
                  "CSAFPID-2476757",
                  "CSAFPID-2476764",
                  "CSAFPID-2476766",
                  "CSAFPID-2476756",
                  "CSAFPID-2476759",
                  "CSAFPID-2476762",
                  "CSAFPID-2476830",
                  "CSAFPID-2476829",
                  "CSAFPID-2476828",
                  "CSAFPID-2423678",
                  "CSAFPID-2423677",
                  "CSAFPID-2059908",
                  "CSAFPID-2059907",
                  "CSAFPID-1864574",
               ],
            },
         ],
         title: "CVE-2025-1257",
      },
      {
         cve: "CVE-2025-25291",
         cwe: {
            id: "CWE-347",
            name: "Improper Verification of Cryptographic Signature",
         },
         notes: [
            {
               category: "other",
               text: "Improper Verification of Cryptographic Signature",
               title: "CWE-347",
            },
            {
               category: "other",
               text: "Interpretation Conflict",
               title: "CWE-436",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2025-25291",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-25291.json",
            },
         ],
         title: "CVE-2025-25291",
      },
      {
         cve: "CVE-2025-25292",
         cwe: {
            id: "CWE-347",
            name: "Improper Verification of Cryptographic Signature",
         },
         notes: [
            {
               category: "other",
               text: "Improper Verification of Cryptographic Signature",
               title: "CWE-347",
            },
            {
               category: "other",
               text: "Interpretation Conflict",
               title: "CWE-436",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2025-25292",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-25292.json",
            },
         ],
         title: "CVE-2025-25292",
      },
      {
         cve: "CVE-2025-27407",
         cwe: {
            id: "CWE-94",
            name: "Improper Control of Generation of Code ('Code Injection')",
         },
         notes: [
            {
               category: "other",
               text: "Improper Control of Generation of Code ('Code Injection')",
               title: "CWE-94",
            },
            {
               category: "general",
               text: "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
               title: "CVSSV4",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-2476827",
               "CSAFPID-2423675",
               "CSAFPID-2423674",
               "CSAFPID-2059906",
               "CSAFPID-2059905",
               "CSAFPID-2059904",
               "CSAFPID-2059903",
               "CSAFPID-2476824",
               "CSAFPID-2476823",
               "CSAFPID-2476822",
               "CSAFPID-2395420",
               "CSAFPID-2395419",
               "CSAFPID-2056775",
               "CSAFPID-2056774",
               "CSAFPID-2476821",
               "CSAFPID-2395418",
               "CSAFPID-2395417",
               "CSAFPID-2056773",
               "CSAFPID-1864576",
               "CSAFPID-1864575",
               "CSAFPID-2476763",
               "CSAFPID-2476758",
               "CSAFPID-2476757",
               "CSAFPID-2476764",
               "CSAFPID-2476766",
               "CSAFPID-2476756",
               "CSAFPID-2476759",
               "CSAFPID-2476762",
               "CSAFPID-2476830",
               "CSAFPID-2476829",
               "CSAFPID-2476828",
               "CSAFPID-2423678",
               "CSAFPID-2423677",
               "CSAFPID-2059908",
               "CSAFPID-2059907",
               "CSAFPID-1864574",
            ],
         },
         references: [
            {
               category: "self",
               summary: "CVE-2025-27407",
               url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-27407.json",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-2476827",
                  "CSAFPID-2423675",
                  "CSAFPID-2423674",
                  "CSAFPID-2059906",
                  "CSAFPID-2059905",
                  "CSAFPID-2059904",
                  "CSAFPID-2059903",
                  "CSAFPID-2476824",
                  "CSAFPID-2476823",
                  "CSAFPID-2476822",
                  "CSAFPID-2395420",
                  "CSAFPID-2395419",
                  "CSAFPID-2056775",
                  "CSAFPID-2056774",
                  "CSAFPID-2476821",
                  "CSAFPID-2395418",
                  "CSAFPID-2395417",
                  "CSAFPID-2056773",
                  "CSAFPID-1864576",
                  "CSAFPID-1864575",
                  "CSAFPID-2476763",
                  "CSAFPID-2476758",
                  "CSAFPID-2476757",
                  "CSAFPID-2476764",
                  "CSAFPID-2476766",
                  "CSAFPID-2476756",
                  "CSAFPID-2476759",
                  "CSAFPID-2476762",
                  "CSAFPID-2476830",
                  "CSAFPID-2476829",
                  "CSAFPID-2476828",
                  "CSAFPID-2423678",
                  "CSAFPID-2423677",
                  "CSAFPID-2059908",
                  "CSAFPID-2059907",
                  "CSAFPID-1864574",
               ],
            },
         ],
         title: "CVE-2025-27407",
      },
   ],
}

cve-2024-13054

Vulnerability from cvelistv5

Published

2025-03-13 05:56

Modified

2025-03-14 14:36

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions.

References

▼	URL	Tags
	https://gitlab.com/gitlab-org/gitlab/-/issues/511004	issue-tracking, permissions-required
	https://hackerone.com/reports/2911928	technical-description, exploit, permissions-required

Impacted products

	Vendor	Product	Version
	GitLab	GitLab	Version: 0 ≤ Version: 17.8 ≤ Version: 17.9 ≤ cpe:2.3:a:gitlab:gitlab::::::::

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-13054",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-14T14:36:04.155613Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-14T14:36:19.463Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               product: "GitLab",
               repo: "git://git@gitlab.com:gitlab-org/gitlab.git",
               vendor: "GitLab",
               versions: [
                  {
                     lessThan: "17.7.7",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.8.5",
                     status: "affected",
                     version: "17.8",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.9.2",
                     status: "affected",
                     version: "17.9",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Thanks [sim4n6](https://hackerone.com/sim4n6) for reporting this vulnerability through our HackerOne bug bounty program",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-770",
                     description: "CWE-770: Allocation of Resources Without Limits or Throttling",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-13T05:56:09.637Z",
            orgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            shortName: "GitLab",
         },
         references: [
            {
               name: "GitLab Issue #511004",
               tags: [
                  "issue-tracking",
                  "permissions-required",
               ],
               url: "https://gitlab.com/gitlab-org/gitlab/-/issues/511004",
            },
            {
               name: "HackerOne Bug Bounty Report #2911928",
               tags: [
                  "technical-description",
                  "exploit",
                  "permissions-required",
               ],
               url: "https://hackerone.com/reports/2911928",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to version 17.9.2, 17.8.5, 17.7.7",
            },
         ],
         title: "Allocation of Resources Without Limits or Throttling in GitLab",
      },
   },
   cveMetadata: {
      assignerOrgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
      assignerShortName: "GitLab",
      cveId: "CVE-2024-13054",
      datePublished: "2025-03-13T05:56:09.637Z",
      dateReserved: "2024-12-30T19:02:23.352Z",
      dateUpdated: "2025-03-14T14:36:19.463Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-25291

Vulnerability from cvelistv5

Published

2025-03-12 20:16

Modified

2025-04-03 20:06

Severity ?

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.

References

▼	URL	Tags
	https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm	x_refsource_CONFIRM
	https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97	x_refsource_MISC
	https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released	x_refsource_MISC
	https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0	x_refsource_MISC
	https://portswigger.net/research/saml-roulette-the-hacker-always-wins	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAML-Toolkits	ruby-saml	Version: < 1.12.4 Version: >= 1.13.0, < 1.18.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-25291",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-03T20:06:31.066662Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-03T20:06:50.415Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-03-15T20:47:03.479Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250314-0010/",
               },
               {
                  url: "https://news.ycombinator.com/item?id=43374519",
               },
            ],
            title: "CVE Program Container",
            x_generator: {
               engine: "ADPogram 0.0.1",
            },
         },
      ],
      cna: {
         affected: [
            {
               product: "ruby-saml",
               vendor: "SAML-Toolkits",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.12.4",
                  },
                  {
                     status: "affected",
                     version: ">= 1.13.0, < 1.18.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 9.3,
                  baseSeverity: "CRITICAL",
                  privilegesRequired: "NONE",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "NONE",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "HIGH",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-347",
                     description: "CWE-347: Improper Verification of Cryptographic Signature",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-436",
                     description: "CWE-436: Interpretation Conflict",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-20T13:21:57.931Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm",
            },
            {
               name: "https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97",
            },
            {
               name: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released",
            },
            {
               name: "https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0",
            },
            {
               name: "https://portswigger.net/research/saml-roulette-the-hacker-always-wins",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portswigger.net/research/saml-roulette-the-hacker-always-wins",
            },
         ],
         source: {
            advisory: "GHSA-4vc4-m8qh-g8jm",
            discovery: "UNKNOWN",
         },
         title: "ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-25291",
      datePublished: "2025-03-12T20:16:12.181Z",
      dateReserved: "2025-02-06T17:13:33.122Z",
      dateUpdated: "2025-04-03T20:06:50.415Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-27407

Vulnerability from cvelistv5

Published

2025-03-12 18:15

Modified

2025-03-12 20:47

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

References

▼	URL	Tags
	https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492	x_refsource_CONFIRM
	https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd	x_refsource_MISC
	https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f	x_refsource_MISC
	https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be	x_refsource_MISC
	https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca	x_refsource_MISC
	https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb	x_refsource_MISC
	https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c	x_refsource_MISC
	https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367	x_refsource_MISC
	https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released	x_refsource_MISC
	https://github.com/github-community-projects/graphql-client	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	rmosolgo	graphql-ruby	Version: >= 1.11.5, < 1.11.8 Version: >= 1.12.0, < 1.12.25 Version: >= 1.13.0, < 1.13.24 Version: >= 2.0.0, < 2.0.32 Version: >= 2.1.0, < 2.1.14 Version: >= 2.2.0, < 2.2.17 Version: >= 2.3.0, < 2.3.21

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-27407",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-12T18:41:38.718466Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-12T18:42:08.976Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "graphql-ruby",
               vendor: "rmosolgo",
               versions: [
                  {
                     status: "affected",
                     version: ">= 1.11.5, < 1.11.8",
                  },
                  {
                     status: "affected",
                     version: ">= 1.12.0, < 1.12.25",
                  },
                  {
                     status: "affected",
                     version: ">= 1.13.0, < 1.13.24",
                  },
                  {
                     status: "affected",
                     version: ">= 2.0.0, < 2.0.32",
                  },
                  {
                     status: "affected",
                     version: ">= 2.1.0, < 2.1.14",
                  },
                  {
                     status: "affected",
                     version: ">= 2.2.0, < 2.2.17",
                  },
                  {
                     status: "affected",
                     version: ">= 2.3.0, < 2.3.21",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-94",
                     description: "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-12T20:47:41.948Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c",
            },
            {
               name: "https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367",
            },
            {
               name: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released",
            },
            {
               name: "https://github.com/github-community-projects/graphql-client",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/github-community-projects/graphql-client",
            },
         ],
         source: {
            advisory: "GHSA-q92j-grw3-h492",
            discovery: "UNKNOWN",
         },
         title: "Remote code execution when loading a crafted GraphQL schema",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-27407",
      datePublished: "2025-03-12T18:15:57.957Z",
      dateReserved: "2025-02-24T15:51:17.268Z",
      dateUpdated: "2025-03-12T20:47:41.948Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-1257

Vulnerability from cvelistv5

Published

2025-03-13 06:00

Modified

2025-03-14 13:44

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs.

References

▼	URL	Tags
	https://gitlab.com/gitlab-org/gitlab/-/issues/519348	issue-tracking, permissions-required
	https://hackerone.com/reports/2984218	technical-description, exploit, permissions-required

Impacted products

	Vendor	Product	Version
	GitLab	GitLab	Version: 12.3 ≤ Version: 17.8 ≤ Version: 17.9 ≤ cpe:2.3:a:gitlab:gitlab::::::::

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-1257",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-14T13:44:00.643584Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-14T13:44:11.141Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               product: "GitLab",
               repo: "git://git@gitlab.com:gitlab-org/gitlab.git",
               vendor: "GitLab",
               versions: [
                  {
                     lessThan: "17.7.7",
                     status: "affected",
                     version: "12.3",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.8.5",
                     status: "affected",
                     version: "17.8",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.9.2",
                     status: "affected",
                     version: "17.9",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Thanks [pwnie](https://hackerone.com/pwnie) for reporting this vulnerability through our HackerOne bug bounty program",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-770",
                     description: "CWE-770: Allocation of Resources Without Limits or Throttling",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-13T06:00:36.063Z",
            orgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            shortName: "GitLab",
         },
         references: [
            {
               name: "GitLab Issue #519348",
               tags: [
                  "issue-tracking",
                  "permissions-required",
               ],
               url: "https://gitlab.com/gitlab-org/gitlab/-/issues/519348",
            },
            {
               name: "HackerOne Bug Bounty Report #2984218",
               tags: [
                  "technical-description",
                  "exploit",
                  "permissions-required",
               ],
               url: "https://hackerone.com/reports/2984218",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to version 17.9.2, 17.8.5, 17.7.7 or above.",
            },
         ],
         title: "Allocation of Resources Without Limits or Throttling in GitLab",
      },
   },
   cveMetadata: {
      assignerOrgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
      assignerShortName: "GitLab",
      cveId: "CVE-2025-1257",
      datePublished: "2025-03-13T06:00:36.063Z",
      dateReserved: "2025-02-12T16:30:44.133Z",
      dateUpdated: "2025-03-14T13:44:11.141Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-12380

Vulnerability from cvelistv5

Published

2025-03-13 05:56

Modified

2025-03-14 14:35

Severity ?

4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.

References

▼	URL	Tags
	https://gitlab.com/gitlab-org/gitlab/-/issues/508557	issue-tracking, permissions-required
	https://hackerone.com/reports/2868951	technical-description, exploit, permissions-required

Impacted products

	Vendor	Product	Version
	GitLab	GitLab	Version: 11.5 ≤ Version: 17.8 ≤ Version: 17.9 ≤ cpe:2.3:a:gitlab:gitlab::::::::

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-12380",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-14T14:32:51.742963Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-14T14:35:18.525Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               product: "GitLab",
               repo: "git://git@gitlab.com:gitlab-org/gitlab.git",
               vendor: "GitLab",
               versions: [
                  {
                     lessThan: "17.7.7",
                     status: "affected",
                     version: "11.5",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.8.5",
                     status: "affected",
                     version: "17.8",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.9.2",
                     status: "affected",
                     version: "17.9",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Thanks [sigitsetiawansss](https://hackerone.com/sigitsetiawansss) for reporting this vulnerability through our HackerOne bug bounty program",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-209",
                     description: "CWE-209: Generation of Error Message Containing Sensitive Information",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-13T05:56:14.642Z",
            orgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            shortName: "GitLab",
         },
         references: [
            {
               name: "GitLab Issue #508557",
               tags: [
                  "issue-tracking",
                  "permissions-required",
               ],
               url: "https://gitlab.com/gitlab-org/gitlab/-/issues/508557",
            },
            {
               name: "HackerOne Bug Bounty Report #2868951",
               tags: [
                  "technical-description",
                  "exploit",
                  "permissions-required",
               ],
               url: "https://hackerone.com/reports/2868951",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to version 17.9.2, 17.8.5, 17.7.7",
            },
         ],
         title: "Generation of Error Message Containing Sensitive Information in GitLab",
      },
   },
   cveMetadata: {
      assignerOrgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
      assignerShortName: "GitLab",
      cveId: "CVE-2024-12380",
      datePublished: "2025-03-13T05:56:14.642Z",
      dateReserved: "2024-12-09T18:30:48.648Z",
      dateUpdated: "2025-03-14T14:35:18.525Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-8402

Vulnerability from cvelistv5

Published

2025-03-13 05:56

Modified

2025-03-13 19:38

Severity ?

3.7 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Summary

An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code.

References

▼	URL	Tags
	https://gitlab.com/gitlab-org/gitlab/-/issues/482813	issue-tracking, permissions-required
	https://hackerone.com/reports/2601569	technical-description, exploit, permissions-required

Impacted products

	Vendor	Product	Version
	GitLab	GitLab	Version: 17.2 ≤ Version: 17.8 ≤ Version: 17.9 ≤ cpe:2.3:a:gitlab:gitlab::::::::

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8402",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-13T19:38:50.911735Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-13T19:38:58.363Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               product: "GitLab",
               repo: "git://git@gitlab.com:gitlab-org/gitlab.git",
               vendor: "GitLab",
               versions: [
                  {
                     lessThan: "17.7.7",
                     status: "affected",
                     version: "17.2",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.8.5",
                     status: "affected",
                     version: "17.8",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.9.2",
                     status: "affected",
                     version: "17.9",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.7,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-77",
                     description: "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-13T05:56:29.590Z",
            orgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            shortName: "GitLab",
         },
         references: [
            {
               name: "GitLab Issue #482813",
               tags: [
                  "issue-tracking",
                  "permissions-required",
               ],
               url: "https://gitlab.com/gitlab-org/gitlab/-/issues/482813",
            },
            {
               name: "HackerOne Bug Bounty Report #2601569",
               tags: [
                  "technical-description",
                  "exploit",
                  "permissions-required",
               ],
               url: "https://hackerone.com/reports/2601569",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to versions 17.7.7, 17.8.5, 17.9.2.",
            },
         ],
         title: "Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab",
      },
   },
   cveMetadata: {
      assignerOrgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
      assignerShortName: "GitLab",
      cveId: "CVE-2024-8402",
      datePublished: "2025-03-13T05:56:29.590Z",
      dateReserved: "2024-09-03T23:01:56.416Z",
      dateUpdated: "2025-03-13T19:38:58.363Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-0652

Vulnerability from cvelistv5

Published

2025-03-13 05:55

Modified

2025-03-14 18:04

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.

References

▼	URL	Tags
	https://gitlab.com/gitlab-org/gitlab/-/issues/514532	issue-tracking, permissions-required
	https://hackerone.com/reports/2947863	technical-description, exploit, permissions-required

Impacted products

	Vendor	Product	Version
	GitLab	GitLab	Version: 16.9 ≤ Version: 17.8 ≤ Version: 17.9 ≤ cpe:2.3:a:gitlab:gitlab::::::::

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0652",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-14T18:04:17.187518Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-14T18:04:47.874Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               product: "GitLab",
               repo: "git://git@gitlab.com:gitlab-org/gitlab.git",
               vendor: "GitLab",
               versions: [
                  {
                     lessThan: "17.7.7",
                     status: "affected",
                     version: "16.9",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.8.5",
                     status: "affected",
                     version: "17.8",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.9.2",
                     status: "affected",
                     version: "17.9",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Thanks [foxribeye](https://hackerone.com/foxribeye) for reporting this vulnerability through our HackerOne bug bounty program",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-863",
                     description: "CWE-863: Incorrect Authorization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-13T05:55:59.744Z",
            orgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            shortName: "GitLab",
         },
         references: [
            {
               name: "GitLab Issue #514532",
               tags: [
                  "issue-tracking",
                  "permissions-required",
               ],
               url: "https://gitlab.com/gitlab-org/gitlab/-/issues/514532",
            },
            {
               name: "HackerOne Bug Bounty Report #2947863",
               tags: [
                  "technical-description",
                  "exploit",
                  "permissions-required",
               ],
               url: "https://hackerone.com/reports/2947863",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to versions 17.7.7, 17.8.5, 17.9.2.",
            },
         ],
         title: "Incorrect Authorization in GitLab",
      },
   },
   cveMetadata: {
      assignerOrgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
      assignerShortName: "GitLab",
      cveId: "CVE-2025-0652",
      datePublished: "2025-03-13T05:55:59.744Z",
      dateReserved: "2025-01-22T16:01:54.566Z",
      dateUpdated: "2025-03-14T18:04:47.874Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-7296

Vulnerability from cvelistv5

Published

2025-03-13 06:00

Modified

2025-03-14 13:43

Severity ?

2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Summary

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.

References

▼	URL	Tags
	https://gitlab.com/gitlab-org/gitlab/-/issues/475056	issue-tracking, permissions-required
	https://hackerone.com/reports/2602274	technical-description, exploit, permissions-required

Impacted products

	Vendor	Product	Version
	GitLab	GitLab	Version: 16.5 ≤ Version: 17.8 ≤ Version: 17.9 ≤ cpe:2.3:a:gitlab:gitlab::::::::

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-7296",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-14T13:43:26.839368Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-14T13:43:35.011Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               product: "GitLab",
               repo: "git://git@gitlab.com:gitlab-org/gitlab.git",
               vendor: "GitLab",
               versions: [
                  {
                     lessThan: "17.7.7",
                     status: "affected",
                     version: "16.5",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.8.5",
                     status: "affected",
                     version: "17.8",
                     versionType: "semver",
                  },
                  {
                     lessThan: "17.9.2",
                     status: "affected",
                     version: "17.9",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2  which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 2.7,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-863",
                     description: "CWE-863: Incorrect Authorization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-13T06:00:54.415Z",
            orgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            shortName: "GitLab",
         },
         references: [
            {
               name: "GitLab Issue #475056",
               tags: [
                  "issue-tracking",
                  "permissions-required",
               ],
               url: "https://gitlab.com/gitlab-org/gitlab/-/issues/475056",
            },
            {
               name: "HackerOne Bug Bounty Report #2602274",
               tags: [
                  "technical-description",
                  "exploit",
                  "permissions-required",
               ],
               url: "https://hackerone.com/reports/2602274",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to versions 17.7.7, 17.8.5, 17.9.2 or above.",
            },
         ],
         title: "Incorrect Authorization in GitLab",
      },
   },
   cveMetadata: {
      assignerOrgId: "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
      assignerShortName: "GitLab",
      cveId: "CVE-2024-7296",
      datePublished: "2025-03-13T06:00:54.415Z",
      dateReserved: "2024-07-30T15:02:08.453Z",
      dateUpdated: "2025-03-14T13:43:35.011Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-25292

Vulnerability from cvelistv5

Published

2025-03-12 20:53

Modified

2025-03-20 13:22

Severity ?

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.

References

▼	URL	Tags
	https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2	x_refsource_CONFIRM
	https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97	x_refsource_MISC
	https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released	x_refsource_MISC
	https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4	x_refsource_MISC
	https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0	x_refsource_MISC
	https://portswigger.net/research/saml-roulette-the-hacker-always-wins	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAML-Toolkits	ruby-saml	Version: < 1.12.4 Version: >= 1.13.0, < 1.18.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2025-03-15T20:47:21.997Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250314-0009/",
               },
               {
                  url: "https://news.ycombinator.com/item?id=43374519",
               },
            ],
            title: "CVE Program Container",
            x_generator: {
               engine: "ADPogram 0.0.1",
            },
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-25292",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-18T14:32:48.636527Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-18T14:32:54.612Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "ruby-saml",
               vendor: "SAML-Toolkits",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.12.4",
                  },
                  {
                     status: "affected",
                     version: ">= 1.13.0, < 1.18.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 9.3,
                  baseSeverity: "CRITICAL",
                  privilegesRequired: "NONE",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "NONE",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "HIGH",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-347",
                     description: "CWE-347: Improper Verification of Cryptographic Signature",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-436",
                     description: "CWE-436: Interpretation Conflict",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-20T13:22:15.681Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2",
            },
            {
               name: "https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97",
            },
            {
               name: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released",
            },
            {
               name: "https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4",
            },
            {
               name: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0",
            },
            {
               name: "https://portswigger.net/research/saml-roulette-the-hacker-always-wins",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portswigger.net/research/saml-roulette-the-hacker-always-wins",
            },
         ],
         source: {
            advisory: "GHSA-754f-8gm6-c4r2",
            discovery: "UNKNOWN",
         },
         title: "Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-25292",
      datePublished: "2025-03-12T20:53:24.353Z",
      dateReserved: "2025-02-06T17:13:33.122Z",
      dateUpdated: "2025-03-20T13:22:15.681Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_ncscnl

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature