CVE-2025-1042CWE-552

Files or Directories Accessible to External Parties in GitLab

Medium · published February 12, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2025-02-12T15:02Z
EPSS history
Timeline
  • 12 FEB 15:02Z
    Files or Directories Accessible to External Parties in GitLab
    cvelistv5