5.8

CVE-2025-2246

Exploit

An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Gitlab ≫ Gitlab SwEditioncommunity Version < 18.1.5
Gitlab ≫ Gitlab SwEditionenterprise Version < 18.1.5
Gitlab ≫ Gitlab SwEditioncommunity Version >= 18.2.0 < 18.2.5
Gitlab ≫ Gitlab SwEditionenterprise Version >= 18.2.0 < 18.2.5
Gitlab ≫ Gitlab Version18.3.0 SwEditioncommunity
Gitlab ≫ Gitlab Version18.3.0 SwEditionenterprise
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.066
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve@gitlab.com 5.8 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.