{"id":"CVE-2024-9512","aliases":["BIT-gitlab-2024-9512","EUVD-2024-54676","GHSA-g6rr-7jqw-c6hc"],"status":"published","title":"Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00255,"percentile":0.17241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2025-06-12T14:02:55Z","modified":"2026-10-30T10:46:53Z","fixes":[{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["18.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.0.2"}]}]}],"products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/497748","tags":["issue-tracking","permissions-required","Broken Link","web","report"]},{"url":"https://hackerone.com/reports/2683469","tags":["technical-description","exploit","permissions-required","Permissions Required","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9512","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g6rr-7jqw-c6hc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9512.json","tags":["advisory"]},{"url":"git://git@gitlab.com:gitlab-org/gitlab.git","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-9512","title":"Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","status":"published","published":"2025-06-12T14:02:55.123Z","modified":"2025-06-12T14:13:37.117Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:05.823187Z"}],"euvd":[{"id":"EUVD-2024-54676","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","status":"published","published":"2025-06-12T14:02:55Z","modified":"2025-06-12T14:13:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.598995Z"}],"ghsa":[{"id":"GHSA-g6rr-7jqw-c6hc","title":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to...","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","status":"published","published":"2025-06-12T15:31:22Z","modified":"2025-06-12T15:31:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2024-9512","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","status":"published","published":"2025-06-12T14:15:29.68Z","modified":"2026-06-17T08:24:42.723Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"CVE-2024-9512","title":"Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","status":"published","published":"2025-06-12T14:02:55.123Z","modified":"2026-10-30T10:46:53.405073892Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"BIT-gitlab-2024-9512","title":"Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.","status":"published","published":"2025-06-14T06:14:22.639Z","modified":"2026-09-10T16:01:38.02061674Z","updated_at":"2026-11-02T15:28:30.70064Z"}]}}