PT-2024-1237 · Github · Github Enterprise Server

Imre Rad

·

Published

2024-01-12

·

Updated

2024-09-11

·

CVE-2024-0507

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.8.13 GitHub Enterprise Server versions prior to 3.9.8 GitHub Enterprise Server versions prior to 3.10.5 GitHub Enterprise Server versions prior to 3.11.3
Description The issue is related to insufficient input validation in the Management Console of GitHub Enterprise Server, allowing an attacker with access to a Management Console user account with the editor role to escalate privileges through a command injection vulnerability. This could enable a remote attacker to execute arbitrary commands and elevate their privileges.
Recommendations For versions prior to 3.8.13, update to version 3.8.13 or later. For versions prior to 3.9.8, update to version 3.9.8 or later. For versions prior to 3.10.5, update to version 3.10.5 or later. For versions prior to 3.11.3, update to version 3.11.3 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20CWE-77

Related Identifiers

BDU:2024-00629
CVE-2024-0507

Affected Products

Github Enterprise Server