CVE-2025-0194

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.

Reserved 2025-01-03 | Published 2025-01-08 | Updated 2025-01-09 | Assigner GitLab

Problem types

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Product status

Default status
unaffected

17.4 before 17.5.5
affected

17.6 before 17.6.3
affected

17.7 before 17.7.1
affected

Credits

This vulnerability has been discovered internally by GitLab team member [Thong Kuah](https://gitlab.com/tkuah). finder

References

gitlab.com/gitlab-org/gitlab/-/issues/489459 (GitLab Issue #489459) issue-tracking permissions-required

about.gitlab.com/...08/patch-release-gitlab-17-7-1-released/

cve.org (CVE-2025-0194)

nvd.nist.gov (CVE-2025-0194)

Download JSON