PT-2024-21917 · Github · Github Enterprise Server

Adrianoapj · Published 2024-03-20 · Updated 2024-03-26 · CVE-2024-2748

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server version 3.12.0

Description A Cross Site Request Forgery issue was identified that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user, with the mitigating factor that user interaction is required. This issue was reported via the GitHub Bug Bounty program.

Recommendations For GitHub Enterprise Server version 3.12.0, update to version 3.12.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the server to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-2748

Affected Products

Github Enterprise Server

References · 5

• https://osv.dev/vulnerability/CVE-2024-2748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2748 · Security Note
• https://t.me/cvenotify/74319 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes/#3.12.1 · Note
• https://twitter.com/RedPacketSec/status/1772565001401782442 · Twitter Post