CVE-2025-4979

Published: May 22, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	Before 17.10.7
Gitlab Gitlab	From 17.11.0 to 17.11.3
Gitlab Gitlab	Before 17.10.7
Gitlab Gitlab	From 17.11.0 to 17.11.3
Gitlab Gitlab	Version 18.0.0
Gitlab Gitlab	Version 18.0.0

Related CWEs

CWE-1220

Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (1)

https://gitlab.com/gitlab-org/gitlab/-/issues/524455

Source: cve@gitlab.com

Broken Link

Timeline

No history available yet.