CVE-2025-2255
Published: 27 March 2025
Summary
CVE-2025-2255 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gitlab Gitlab. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Proper error handling ensures error messages do not reflect unfiltered user input, directly preventing XSS exploitation via the vulnerable GitLab AppSec error messages.
Information output filtering encodes or sanitizes data prior to rendering, blocking XSS payloads from executing in users' browsers when reflected in error messages.
Input validation detects and rejects malicious scripts before they can be processed and reflected in error messages, reducing the risk of XSS attacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS vuln in public-facing GitLab web app enables T1190 (exploit public-facing application) and T1059.007 (JavaScript execution via injected scripts in error messages), facilitating session theft.
NVD Description
An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.
Deeper analysisAI
CVE-2025-2255 is a cross-site scripting (XSS) vulnerability, classified under CWE-79, in the AppSec component of GitLab Enterprise Edition (EE) and Community Edition (CE). It affects all versions from 13.5.0 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1. The flaw stems from certain error messages that could enable XSS attacks.
With a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the vulnerability can be exploited over the network by an attacker possessing low privileges. Exploitation requires user interaction and low attack complexity, but successful attacks change scope and result in high impacts to confidentiality and integrity, such as potential session theft or manipulation of user data in the victim's browser.
Mitigation requires upgrading to GitLab versions 17.8.6, 17.9.3, or 17.10.1 or later. Further details on the issue and resolution are documented in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/524635 and the corresponding HackerOne report at https://hackerone.com/reports/2994150.
Details
- CWE(s)