CVE-2025-1212
Published: 12 February 2025
Summary
CVE-2025-1212 is a medium-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Code Repositories (T1213.003); ranked at the 16.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through patching directly prevents exploitation of this information disclosure vulnerability as recommended by upgrading GitLab to fixed versions.
Validating information inputs rejects crafted requests that could trigger the backend server to disclose sensitive information.
Filtering information outputs prevents the exposure of sensitive data in responses to low-privileged users' crafted requests.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct info disclosure from GitLab code repository via crafted request enables T1213.003.
NVD Description
An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.
Deeper analysisAI
CVE-2025-1212 is an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. The issue enables an attacker to send a crafted request to a backend server, resulting in the exposure of sensitive information. It is associated with CWE-497 and carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
The vulnerability can be exploited by a low-privileged authenticated user over the network with low attack complexity and no requirement for user interaction. Successful exploitation achieves a low-impact disclosure of confidential information without impacting integrity or availability.
Mitigation is available by upgrading to GitLab 17.6.5, 17.7.4, 17.8.2, or later versions. Further details on the issue and resolution are provided in the GitLab security advisory at https://gitlab.com/gitlab-org/gitlab/-/issues/502196.
Details
- CWE(s)