PT-2024-27175 · Github · Github Enterprise Server
R31N
·
Published
2024-04-19
·
Updated
2024-04-19
·
CVE-2024-3684
CVSS v3.1
8.0
High
| Vector | AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GitHub Enterprise Server versions prior to 3.12
GitHub Enterprise Server versions 3.9 through 3.9.12
GitHub Enterprise Server versions 3.10 through 3.10.9
GitHub Enterprise Server versions 3.11 through 3.11.7
Description
A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability was reported via the GitHub Bug Bounty program.
Recommendations
For GitHub Enterprise Server versions prior to 3.9.13, update to version 3.9.13 or later.
For GitHub Enterprise Server versions 3.10 through 3.10.9, update to version 3.10.10 or later.
For GitHub Enterprise Server versions 3.11 through 3.11.7, update to version 3.11.8 or later.
For GitHub Enterprise Server versions 3.12 through 3.12.1, update to version 3.12.2 or later.
Fix
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Github Enterprise Server