Improper Neutralization of HTTP Headers for Scripting Syntax in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2025-1908
Published: April 23, 2025
Vulnerability identifier: #VU107882
CSH Severity: Medium
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-1908
CWE-ID: CWE-644
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform spoofing attack.
The vulnerability exists due to improper input validation when processing Network Error Logging (NEL) HTTP headers in Maven dependency proxy. A remote user can inject a Network Error Logging (NEL) HTTP header into server response and potentially take over an arbitrary account.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
How to mitigate CVE-2025-1908
Install updates from vendor's website.
Gitlab Community Edition - addressed in versions 17.9.7, 17.10.5, 17.11.1
GitLab Enterprise Edition - addressed in versions 17.9.7, 17.10.5, 17.11.1
GitLab Enterprise Edition - addressed in versions 17.9.7, 17.10.5, 17.11.1