PT-2024-20385 · Github · Github Enterprise Server

Inspector-Ambitious · Published 2024-04-19 · Updated 2024-04-19 · CVE-2024-2440

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.13 GitHub Enterprise Server versions 3.9 through 3.9.12 GitHub Enterprise Server versions 3.10 through 3.10.9 GitHub Enterprise Server versions 3.11 through 3.11.7 GitHub Enterprise Server versions 3.12 through 3.12.0

Description A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This issue was reported via the GitHub Bug Bounty program.

Recommendations For GitHub Enterprise Server versions prior to 3.9.13, update to version 3.9.13. For GitHub Enterprise Server versions 3.10, update to version 3.10.10. For GitHub Enterprise Server versions 3.11, update to version 3.11.8. For GitHub Enterprise Server versions 3.12, update to version 3.12.1. As a temporary workaround, consider restricting access to GraphQL mutations that alter repository permissions for detached repositories until a patch is available.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-2440

Affected Products

Github Enterprise Server

References · 7

• https://osv.dev/vulnerability/CVE-2024-2440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2440 · Security Note
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2 · Note
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10 · Note
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8 · Note
• https://t.me/cvenotify/77500 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13 · Note