CVE-2024-3035: 
GitLab vulnerability analysis and mitigation

A permission check vulnerability (CVE-2024-3035) was identified in GitLab CE/EE affecting all versions from 8.12 through versions prior to 17.0.6, 17.1.4, and 17.2.2. The vulnerability was discovered and reported through GitLab's HackerOne bug bounty program by researcher pwnie (GitLab Release).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 8.1 (HIGH) according to NVD's assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). GitLab's own assessment rated it at 6.8 (MEDIUM) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

The vulnerability allowed LFS (Large File Storage) tokens to read and write to user-owned repositories, potentially compromising the confidentiality and integrity of repository data (GitLab Release).

The vulnerability requires network access and low privileges to exploit, though GitLab's assessment suggests high attack complexity is needed. No public exploits have been confirmed in the wild (NVD).

GitLab has released patches in versions 17.0.6, 17.1.4, and 17.2.2 to address this vulnerability. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the necessary fixes (GitLab Release).