---
cve: "CVE-2025-5819"
severity: "MEDIUM"
cvss: 5.0
epss: "0.3%"
vendor: "GitLab"
kev: false
exploited: false
published: "2025-08-13 18:15:32"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T18:17:02+01:00"
---

# CVE-2025-5819

> 5.0 MEDIUM

## Beschreibung

An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitLab**
- State: PUBLISHED
- Stand: 2025-08-29 16:23:04
- CNA-CVSS: **5.0** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-732** — Incorrect Permission Assignment for Critical Resource
  The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_
- [CAPEC-17 — Using Malicious Files](https://capec.mitre.org/data/definitions/17.html) _(Severity: Very High)_
- [CAPEC-60 — Reusing Session IDs (aka Session Replay)](https://capec.mitre.org/data/definitions/60.html) _(Severity: High)_
- [CAPEC-122 — Privilege Abuse](https://capec.mitre.org/data/definitions/122.html) _(Severity: Medium)_
- [CAPEC-127 — Directory Indexing](https://capec.mitre.org/data/definitions/127.html) _(Severity: Medium)_
- [CAPEC-180 — Exploiting Incorrectly Configured Access Control Security Levels](https://capec.mitre.org/data/definitions/180.html) _(Severity: Medium)_
- [CAPEC-206 — Signing Malicious Code](https://capec.mitre.org/data/definitions/206.html) _(Severity: Very High)_
- [CAPEC-234 — Hijacking a privileged process](https://capec.mitre.org/data/definitions/234.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)
- [T1574.005 — Hijack Execution Flow: Executable Installer File Permissions](https://attack.mitre.org/techniques/T1574/005/)
- [T1134.001 — Access Token Manipulation:Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001/)
- [T1550.004 — Use Alternate Authentication Material:Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/)
- [T1548 — Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)
- [T1083 — File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)
- [T1553.002 — Subvert Trust Controls:Code Signing](https://attack.mitre.org/techniques/T1553/002/)

## Patch verfügbar (OSV)

- bfd493869858083febee3788e111b5503caf492c (Commit)
- 47fe1a97b4e6da353e1721a4c750b3fa0770d2e2 (Commit)

## BSI-Hinweise (deutsch)

- [GitLab: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2025-1816) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Benutzerkonten zu übernehmen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

## Referenzen

- <https://gitlab.com/gitlab-org/gitlab/-/issues/548165>
- <https://hackerone.com/reports/3137660>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-5819/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_