PT-2024-20491 · Github · Github Enterprise Server

Inspector-Ambitious · Published 2024-03-20 · Updated 2025-09-04 · CVE-2024-2469

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.8.0 through 3.12.0

Description An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This issue was reported via the GitHub Bug Bounty program. Remote attacks are possible, allowing an attacker to potentially compromise the security of repositories.

Recommendations For GitHub Enterprise Server versions 3.8.0 through 3.8.16, update to version 3.8.17. For GitHub Enterprise Server versions 3.9.0 through 3.9.11, update to version 3.9.12. For GitHub Enterprise Server versions 3.10.0 through 3.10.8, update to version 3.10.9. For GitHub Enterprise Server versions 3.11.0 through 3.11.6, update to version 3.11.7. For GitHub Enterprise Server versions 3.12.0, update to version 3.12.1.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-2469

Affected Products

Github Enterprise Server

References · 11

• https://osv.dev/vulnerability/CVE-2024-2469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2469 · Security Note
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.9 · Note
• https://twitter.com/cracbot/status/1770899656379129977 · Twitter Post
• https://t.me/cveNotify/134256 · Telegram Post
• https://t.me/cvenotify/74317 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.1 · Note
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.7 · Note
• https://twitter.com/oktsec/status/1771492529080258708 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.12 · Note
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.17 · Note