CVE-2024-3035
published 2024-08-08CVE-2024-3035: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2…
PriorityP344high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.36%
27.4th percentile
A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 17.3.5-2 (sid) | gitlab 17.3.5-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 17.1 < 17.1.4 | 17.1.4 |
| gitlab | gitlab | >= 17.1.0 < 17.1.4 | 17.1.4 |
| gitlab | gitlab | >= 17.2 < 17.2.2 | 17.2.2 |
| gitlab | gitlab | >= 17.2.0 < 17.2.2 | 17.2.2 |
| gitlab | gitlab | >= 8.12 < 17.0.6 | 17.0.6 |
| gitlab | gitlab | >= 8.12.0 < 17.0.6 | 17.0.6 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
osv8.1HIGH
vendor_debian6.8MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rvj3-54w6-vrw6: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8
ghsa_unreviewed·2024-08-08
CVE-2024-3035 [MEDIUM] CWE-639 GHSA-rvj3-54w6-vrw6: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8
A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
OSV
CVE-2024-3035: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8
osv·2024-08-08·CVSS 8.1
CVE-2024-3035 [HIGH] CVE-2024-3035: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8
A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
Red Hat
kernel: wifi: mt76: disable napi on driver removal
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2025-38009 [MEDIUM] CWE-20 kernel: wifi: mt76: disable napi on driver removal
kernel: wifi: mt76: disable napi on driver removal
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: disable napi on driver removal
A warning on driver removal started occurring after commit 9dd05df8403b
("net: warn if NAPI instance wasn't shut down"). Disable tx napi before
deleting it in mt76_dma_cleanup().
WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100
CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)
Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024
RIP: 0010:__netif_napi_del_locked+0xf0/0x100
Call Trace:
mt76_dma_cleanup+0x54/0x2f0 [mt76]
mt7921_pci_remove+0xd5/0x190 [mt7921e]
pci_device_remove+0x47/0xc0
device_release_driver_internal+0x19e/0x200
driver_
GitLab
CVE-2024-3035: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17
vendor_gitlab·2024-08-08·CVSS 6.8
CVE-2024-3035 [MEDIUM] CWE-639 CVE-2024-3035: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17
CVE-2024-3035: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
Debian
CVE-2024-3035: gitlab - A permission check vulnerability in GitLab CE/EE affecting all versions starting...
vendor_debian·2024·CVSS 6.8
CVE-2024-3035 [MEDIUM] CVE-2024-3035: gitlab - A permission check vulnerability in GitLab CE/EE affecting all versions starting...
A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
Scope: local
sid: resolved (fixed in 17.3.5-2)
No detection rules found.
No public exploits indexed.
2024-08-08
Published