CNNVD-202511-1783 Information

CNNVD ID

CNNVD-202511-1783

Related CVE

CVE-2025-7736

• CNNVD Published: 2025-11-15

Description (Chinese)

GitLab是美国GitLab公司的一个开源的端到端软件开发平台，具有内置的版本控制、问题跟踪、代码审查、CI/CD（持续集成和持续交付）等功能。 GitLab CE和EE 17.9版本至18.3.6之前版本、18.4版本至18.4.4之前版本和18.5版本至18.5.2之前版本存在安全漏洞，该漏洞源于OAuth提供者认证绕过问题，可能导致GitLab Pages内容泄露。

Description (English)

GitLab is an open-source end-to-end software development platform for United States GitLab with built-in version control, problem tracking, code review, CI/CD (continuous integration and continuous delivery). There is a security loophole between GitLab CE and EE 17.9 to pre-18.3.6, pre 18.4 to pre 18.4.4 and pre 18.5 to pre-18.5.2, which stems from the problem of OAuth certification bypassing, which could lead to the leaking of GitLab Pages.

Hazard Level

Critical

Vulnerability Type

其他

Affected Vendor

GitLab

Published

2025-11-15

Last Modified

2026-02-24

References

https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/ https://hackerone.com/reports/3250156 https://gitlab.com/gitlab-org/gitlab/-/issues/556098 https://access.redhat.com/security/cve/cve-2025-7736

Patch

https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/