CVE-2024-3035

Published: Aug 8, 2024Modified: Aug 29, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 17.1.0 to 17.1.4
Gitlab Gitlab	From 17.2.0 to 17.2.2
Gitlab Gitlab	From 8.12.0 to 17.0.6
Gitlab Gitlab	From 17.1 to 17.1.4
Gitlab Gitlab	From 17.2.0 to 17.2.2
Gitlab Gitlab	From 8.12.0 to 17.0.6

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/452297

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/2424715

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.