What is the CVSS score of CVE-2025-2443?

CVE-2025-2443 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gitlab are affected by CVE-2025-2443?

GitLab EE instances are vulnerable to cross-site scripting (XSS) and content security policy bypass attacks that could allow attackers to steal user sessions, credentials, or perform unauthorized…. A patch is available.

How to fix or mitigate CVE-2025-2443?

Within 24 hours: Identify all GitLab EE instances and their versions; assess whether affected versions (16.6-17.9.6, 17.10.0-17.10.4, 17.11.0) are in use and internet-facing. Within 7 days: Implement WAF rules to block suspicious XSS payloads targeting GitLab; restrict GitLab access to corporate networks via VPN or IP allowlisting; disable or restrict user-generated content features if operationally feasible. Within 30 days: Plan immediate upgrade to patched versions (17.9.7+, 17.10.5+, 17.11.1+) as patches become available; conduct a security audit of GitLab configurations and user activity logs for exploitation signs.

Gitlab CVE-2025-2443

EUVD-2025-27718 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-20 cve@gitlab.com

Gitlab Authentication Bypass

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-27718

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 18:15 nvd

HIGH 8.7

DescriptionCVE.org

An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

AnalysisAI

A security vulnerability in all (CVSS 8.7) that allows for cross-site-scripting attack and content security policy bypass. High severity vulnerability requiring prompt remediation.