CVE-2024-3035

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-3035

Severity

6.8

Medium

CVSS V3

Summary

Authorization Bypass Through User-Controlled Key in GitLab

Description

A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.

References

https://images.chainguard.dev/security/CGA-jxvf-wc9r-9m42
https://github.com/advisories/GHSA-rvj3-54w6-vrw6
https://images.chainguard.dev/security/CGA-chg8-m325-842q
https://images.chainguard.dev/security/CGA-9g97-rqvx-v9wp
https://images.chainguard.dev/security/CGA-7w5p-24gr-xww3
https://images.chainguard.dev/security/CGA-xw94-9g8p-vqr3
https://images.chainguard.dev/security/CGA-9wp6-63rp-j3mr
https://images.chainguard.dev/security/CGA-cp69-h4hq-p6v3
https://images.chainguard.dev/security/CGA-wf4q-h22r-fm74
https://images.chainguard.dev/security/git%3A%2F%2Fgit%40gitlab.com%3Agitlab-org%2Fgitlab.git
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3035.json
https://gitlab.com/gitlab-org/gitlab/-/issues/452297
https://hackerone.com/reports/2424715
https://nvd.nist.gov/vuln/detail/CVE-2024-3035

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CVE-2024-3035

Severity

Summary

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company