BIT-gitlab-2024-9512

vendorUSosv

Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

view advisory published 2025-06-14Licence: per source

An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-9512US	medium5.9	0.25% (17th)	—	2025-06-12
An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repositor…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/497748WEB
https://hackerone.com/reports/2683469WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-9512WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan