CVE-2025-13611
BaseFortify
Publication date: 2025-11-26
Last updated on: 2026-03-31
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 13.2.0 (inc) to 18.4.5 (exc) |
| gitlab | gitlab | From 13.2.0 (inc) to 18.4.5 (exc) |
| gitlab | gitlab | From 18.5.0 (inc) to 18.5.3 (exc) |
| gitlab | gitlab | From 18.5.0 (inc) to 18.5.3 (exc) |
| gitlab | gitlab | 18.6.0 |
| gitlab | gitlab | 18.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab CE/EE versions before certain fixed releases could allow an authenticated user with access to specific logs to obtain sensitive tokens under certain conditions.
How can this vulnerability impact me? :
An attacker who is an authenticated user with access to certain logs could potentially obtain sensitive tokens, which might lead to unauthorized access or misuse of those tokens.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update GitLab CE/EE to a fixed version: 18.4.5 or later for 18.4.x, 18.5.3 or later for 18.5.x, and 18.6.1 or later for 18.6.x. Restrict access to logs to only trusted users and review permissions for authenticated users to limit exposure to sensitive tokens.