« Volver al listado

CVE-2025-4700

Estado: AnalizadaMedia (6.1)—

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitlab — Gitlab

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-4700",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-4700",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-25T03:55:23.228372Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@gitlab.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@gitlab.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
          ],
          "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
          "vendor": "GitLab",
          "product": "GitLab",
          "versions": [
            {
              "status": "affected",
              "version": "15.10",
              "lessThan": "18.0.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1",
              "lessThan": "18.1.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.2",
              "lessThan": "18.2.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-23T18:15:27.750",
  "references": [
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/542915",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@gitlab.com"
    },
    {
      "url": "https://hackerone.com/reports/3120062",
      "tags": [
        "Permissions Required"
      ],
      "source": "cve@gitlab.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@gitlab.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.10 hasta la 18.0.5, la 18.1 hasta la 18.1.3 y la 18.2 hasta la 18.2.1 que, en circunstancias específicas, podría haber permitido que un atacante exitoso desencadenara una representación de contenido no deseada que condujera a XSS."
    }
  ],
  "lastModified": "2026-06-17T09:33:48.933",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4843D35-6AAB-4476-B87A-411B03F12CFB",
              "versionEndExcluding": "18.0.5",
              "versionStartIncluding": "15.10.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B296ED8-416F-454C-85B7-D537A0C12B35",
              "versionEndExcluding": "18.0.5",
              "versionStartIncluding": "15.10.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6FBDC48-B16F-4DE3-8A25-650EA1B3A7E6",
              "versionEndExcluding": "18.1.3",
              "versionStartIncluding": "18.1.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BD9DE80-2A4C-421F-98AC-25F160771956",
              "versionEndExcluding": "18.1.3",
              "versionStartIncluding": "18.1.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:18.2:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C56C6B73-A79C-4B34-82FA-6451CCA9C093"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:18.2:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8931BAA0-5961-46EC-BF0C-62EE4E8A7BE1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@gitlab.com"
}