PT-2025-29071 · Gitlab · Gitlab Ce/Ee

CVE-2025-3396

·

Publicado

2025-07-09

·

Atualizado

2025-07-16

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.3 through 17.11.5 GitLab EE versions 18.0 through 18.0.3 GitLab EE versions 18.1 through 18.1.1
Description: An issue exists in GitLab EE that allows authenticated project owners to bypass group-level forking restrictions by manipulating API requests.
Recommendations: Update GitLab EE to version 17.11.6 or later. Update GitLab EE to version 18.0.4 or later. Update GitLab EE to version 18.1.2 or later.

Exploit

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2025-09094
BIT-GITLAB-2025-3396
CVE-2025-3396

Produtos afetados

Gitlab Ce/Ee