CVE-2024-9512

An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/497748	Broken Link
https://hackerone.com/reports/2683469	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

08 Aug 2025, 18:22

Type	Values Removed	Values Added
Summary		(es) Se ha detectado un problema en GitLab EE que afecta a todas las versiones anteriores a la 17.10.8, 17.11 anteriores a la 17.11.4 y 18.0 anteriores a la 18.0.2. Es posible que se haya clonado un repositorio privado en caso de una condición de ejecución cuando un nodo secundario no está sincronizado.
First Time		Gitlab Gitlab gitlab
CPE		cpe:2.3:a:gitlab:gitlab:::::community:::* cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/497748 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/497748 - Broken Link
References	~~() https://hackerone.com/reports/2683469 -~~	() https://hackerone.com/reports/2683469 - Permissions Required

12 Jun 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-12 14:15

Updated : 2025-08-08 18:22

NVD link : CVE-2024-9512

Mitre link : CVE-2024-9512

CVE.ORG link : CVE-2024-9512

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2024-9512", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2025-06-12T14:15:29.680", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/497748", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2683469", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync."}, {"lang": "es", "value": "Se ha detectado un problema en GitLab EE que afecta a todas las versiones anteriores a la 17.10.8, 17.11 anteriores a la 17.11.4 y 18.0 anteriores a la 18.0.2. Es posible que se haya clonado un repositorio privado en caso de una condici\u00f3n de ejecuci\u00f3n cuando un nodo secundario no est\u00e1 sincronizado."}], "lastModified": "2025-08-08T18:22:08.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "61E74077-8E03-45E9-B5C0-50D1C5706D29", "versionEndExcluding": "17.10.8"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "AE1C02F8-A03B-4647-8FA2-5C297D86BE26", "versionEndExcluding": "17.10.8"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C804F9B0-8B23-4160-B24E-199411A81B95", "versionEndExcluding": "17.11.4", "versionStartIncluding": "17.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CEAA838C-7B3C-45AF-9D3D-BD5DE41E57BC", "versionEndExcluding": "17.11.4", "versionStartIncluding": "17.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "7BD21B25-753E-48AB-B0D4-DFE90A135C04", "versionEndExcluding": "18.0.2", "versionStartIncluding": "18.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6224AE70-D146-4A3B-BD4E-2853891F24FA", "versionEndExcluding": "18.0.2", "versionStartIncluding": "18.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}