Exposição de GitLab

Development, Issue trackers
318
score de exposição
658
sites usam
4
em exploração
24
críticos
Análise Vexday

Com 1.068 CVEs catalogadas e 78 novas vulnerabilidades registradas nos últimos 90 dias, o GitLab apresenta um volume de exposição que exige monitoramento contínuo. A taxa de exploração ativa — 4 entradas no catálogo KEV da CISA, representando 0,37% do total — está abaixo da média geral do catálogo (0,45%), embora esse dado não elimine a atenção necessária às falhas confirmadas. A vulnerabilidade CVE-2021-22205 concentra o maior risco imediato, com score EPSS de 0,9973, indicando altíssima probabilidade de exploração ativa, e deve ser tratada como prioridade absoluta em qualquer plano de remediação. O tipo de falha mais recorrente, CWE-770 (alocação de recursos sem limite ou controle), combinado com 24 vulnerabilidades de severidade crítica, sugere atenção estrutural às práticas de desenvolvimento e à gestão de recursos na plataforma.

CVEs

1.087 resultados
CVE-2022-4255MEDIUMAn info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 whiEPSS 0.5%CVE-2023-6371HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2024-1493MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.5%CVE-2024-12379MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2024-4025MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.5%CVE-2025-10569MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2025-0194MEDIUMInsertion of Sensitive Information into Externally-Accessible File or Directory in GitLabEPSS 0.5%CVE-2024-0456MEDIUMDirect Request ('Forced Browsing') in GitLabEPSS 0.5%CVE-2025-0993HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2023-5963LOWAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.5%CVE-2024-4201MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2023-3906LOWImproper Validation of Specified Type of Input in GitLabEPSS 0.5%CVE-2024-9693HIGHIncorrect Authorization in GitLabEPSS 0.5%CVE-2025-0555HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2021-22202LOWAn issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in EPSS 0.5%CVE-2025-0475HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2022-0154HIGHAn issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5EPSS 0.5%CVE-2026-3988HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.5%CVE-2024-1947MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) in GitLabEPSS 0.5%CVE-2025-14513HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.5%