PT-2024-17981 · Github · Github Enterprise Server
Inspector-Ambitious
·
Published
2024-02-13
·
Updated
2024-03-05
·
CVE-2024-1369
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GitHub Enterprise Server versions prior to 3.12
GitHub Enterprise Server version 3.11.5
GitHub Enterprise Server version 3.10.7
GitHub Enterprise Server version 3.9.10
GitHub Enterprise Server version 3.8.15
Description
A command injection issue was identified in GitHub Enterprise Server, allowing an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collectd configurations. Exploitation required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role.
Recommendations
For GitHub Enterprise Server versions prior to 3.12, update to version 3.12 or later to resolve the issue.
For GitHub Enterprise Server version 3.11.5, no additional action is required as this version already contains the fix.
For GitHub Enterprise Server version 3.10.7, no additional action is required as this version already contains the fix.
For GitHub Enterprise Server version 3.9.10, no additional action is required as this version already contains the fix.
For GitHub Enterprise Server version 3.8.15, no additional action is required as this version already contains the fix.
As a temporary workaround, consider restricting access to the Management Console with the editor role until a patch is applied.
Fix
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Github Enterprise Server