CVE-2025-0194 MEDIUM

CVE-2025-0194: Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-538
Published January 8, 2025
Last update January 9, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.

Key dates

02Disclosure timeline

January 8, 2025 CVE published
January 9, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-4471 TG8 Firewall Unauthenticated User Password Disclosure CVE-2026-50099 Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory CVE-2025-36372 IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables CVE-2022-43933 configuration secrets are logged in support-save CVE-2023-7062 Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal