CVE-2025-3396

{"id": "CVE-2025-3396", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-07-10T09:15:29.980", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/534636", "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3079956", "source": "cve@gitlab.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 13.3 hasta la 17.11.6, la 18.0 hasta la 18.0.4 y la 18.1 hasta la 18.1.2 que podr\u00eda haber permitido a los propietarios de proyectos autenticados eludir las restricciones de bifurcaci\u00f3n a nivel de grupo manipulando las solicitudes de API."}], "lastModified": "2025-07-10T13:17:30.017", "sourceIdentifier": "cve@gitlab.com"}