CVE-2025-4976
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-07-24
Last updated on: 2025-07-28
Assigner: GitLab Inc.
Description
Description
An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 17.0.0 (inc) to 18.0.5 (exc) |
| gitlab | gitlab | From 18.1.0 (inc) to 18.1.3 (exc) |
| gitlab | gitlab | 18.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo | |
| CWE-213 | The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab EE affects certain versions and could allow an attacker, under specific conditions, to access internal notes in GitLab Duo responses that they should not normally see.
How can this vulnerability impact me? :
The vulnerability could lead to unauthorized disclosure of internal notes within GitLab Duo responses, potentially exposing sensitive information to attackers with limited privileges.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70