Search criteria

2 vulnerabilities found for language_server by gitlab

CVE-2025-8279 (GCVE-0-2025-8279)

Vulnerability from nvd – Published: 2025-07-28 14:04 – Updated: 2025-07-28 14:23
VLAI
Title
Missing Authentication for Critical Function in GitLab Language Server
Summary
Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution
Severity
8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
URL Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/538205 issue-trackingpermissions-required
Impacted products
Vendor Product Version
GitLab GitLab Language Server Affected: 7.6.0 , < 7.30.0 (semver)
    cpe:2.3:a:gitlab:gitlab-language-server:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8279",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-28T14:23:00.677844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-28T14:23:37.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab-language-server:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "GitLab Language Server",
          "vendor": "GitLab",
          "versions": [
            {
              "lessThan": "7.30.0",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T14:04:28.764Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "name": "GitLab Issue #538205",
          "tags": [
            "issue-tracking",
            "permissions-required"
          ],
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/538205"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the affected editor extension to an appropriate fixed version."
        }
      ],
      "title": "Missing Authentication for Critical Function in GitLab Language Server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2025-8279",
    "datePublished": "2025-07-28T14:04:28.764Z",
    "dateReserved": "2025-07-28T13:04:22.709Z",
    "dateUpdated": "2025-07-28T14:23:37.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-8279 (GCVE-0-2025-8279)

Vulnerability from cvelistv5 – Published: 2025-07-28 14:04 – Updated: 2025-07-28 14:23
VLAI
Title
Missing Authentication for Critical Function in GitLab Language Server
Summary
Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution
Severity
8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
URL Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/538205 issue-trackingpermissions-required
Impacted products
Vendor Product Version
GitLab GitLab Language Server Affected: 7.6.0 , < 7.30.0 (semver)
    cpe:2.3:a:gitlab:gitlab-language-server:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8279",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-28T14:23:00.677844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-28T14:23:37.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab-language-server:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "GitLab Language Server",
          "vendor": "GitLab",
          "versions": [
            {
              "lessThan": "7.30.0",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T14:04:28.764Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "name": "GitLab Issue #538205",
          "tags": [
            "issue-tracking",
            "permissions-required"
          ],
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/538205"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the affected editor extension to an appropriate fixed version."
        }
      ],
      "title": "Missing Authentication for Critical Function in GitLab Language Server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2025-8279",
    "datePublished": "2025-07-28T14:04:28.764Z",
    "dateReserved": "2025-07-28T13:04:22.709Z",
    "dateUpdated": "2025-07-28T14:23:37.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}