CVE-2025-1198

Published: Feb 13, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	16.11.0 ≤ version < 17.6.5
Gitlab Gitlab	17.7.0 ≤ version < 17.7.4
Gitlab Gitlab	17.8.0 ≤ version < 17.8.2
Gitlab Gitlab	16.11.0 ≤ version < 17.6.5
Gitlab Gitlab	17.7.0 ≤ version < 17.7.4
Gitlab Gitlab	17.8.0 ≤ version < 17.8.2

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

https://gitlab.com/gitlab-org/gitlab/-/issues/511477

Source: cve@gitlab.com

Broken Link

Timeline

No history available yet.