CVE-2025-0362

An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/512425	Broken Link
https://hackerone.com/reports/2926425	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

07 Aug 2025, 18:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gitlab:gitlab:::::community:::* cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
First Time		Gitlab Gitlab gitlab
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/512425 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/512425 - Broken Link
References	~~() https://hackerone.com/reports/2926425 -~~	() https://hackerone.com/reports/2926425 - Permissions Required

11 Apr 2025, 15:39

Type	Values Removed	Values Added
Summary		(es) Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 7.7 hasta la 17.8.7, la 17.9 hasta la 17.9.6 y la 17.10 hasta la 17.10.4. Bajo ciertas condiciones, un atacante podría potencialmente engañar a los usuarios para que autoricen involuntariamente acciones confidenciales en su nombre.

10 Apr 2025, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-10 15:16

Updated : 2025-08-07 18:34

NVD link : CVE-2025-0362

Mitre link : CVE-2025-0362

CVE.ORG link : CVE-2025-0362

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-0362", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-04-10T15:16:02.337", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/512425", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2926425", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf."}, {"lang": "es", "value": " Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 7.7 hasta la 17.8.7, la 17.9 hasta la 17.9.6 y la 17.10 hasta la 17.10.4. Bajo ciertas condiciones, un atacante podr\u00eda potencialmente enga\u00f1ar a los usuarios para que autoricen involuntariamente acciones confidenciales en su nombre."}], "lastModified": "2025-08-07T18:34:06.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "9117D28C-FE99-4EF0-83F3-CA5D78B154D6", "versionEndExcluding": "17.8.7", "versionStartIncluding": "7.7.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E5662965-ECBA-4B15-9BCE-B60C742E0C52", "versionEndExcluding": "17.8.7", "versionStartIncluding": "7.7.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "DA3826E3-A00E-4E5A-81A0-28DCB2BE10B5", "versionEndExcluding": "17.9.6", "versionStartIncluding": "17.9.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2BE64DE3-7E01-4B8C-81D3-A1443D2450A3", "versionEndExcluding": "17.9.6", "versionStartIncluding": "17.9.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "73742B4C-F768-4F0D-A34D-B551A3BC6177", "versionEndExcluding": "17.10.4", "versionStartIncluding": "17.10.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "F95150D7-C98E-4177-AB2B-8E9B7100DF2D", "versionEndExcluding": "17.10.4", "versionStartIncluding": "17.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}