CVE-2025-13978 — Information Exposure via Error Message in Gitlab

CWE-209 — Information Exposure via Error MessageCWE-476 — NULL Pointer Dereference7 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 94.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
GitlabDebian GitlabGitlab CE+4 more
Timeline
PublishedDec 11

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private projects they do not have access through API requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages9 packages

▶CVEListV5gitlab/gitlab17.5 — 18.4.6+2
▶NVDgitlab/gitlab17.5.0 — 18.4.6+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-mp63-3qcj-f8c7: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17↗2025-12-11
▶
OSV
CVE-2025-13978: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17↗2025-12-11
▶

📋Vendor Advisories

3
GitLab
CVE-2025-13978: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could h↗2025-12-11
▶
Microsoft
LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference↗2025-08-12
▶
Debian
CVE-2025-13978: gitlab - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 ...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-13978 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶