PT-2024-37177 · Github · Github Enterprise Server

Ahacker1 · Published 2024-07-16 · Updated 2024-09-17 · CVE-2024-5815

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/S:N/AU:N/R:U/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14

Description: A Cross-Site Request Forgery issue in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. The attacker would have to be a trusted GitHub Enterprise Server user, and the victim would have to visit a tag in the attacker's fork of their own repository.

Recommendations: For versions prior to 3.9.17, update to version 3.9.17. For versions prior to 3.10.14, update to version 3.10.14. For versions prior to 3.11.12, update to version 3.11.12. For versions prior to 3.12.6, update to version 3.12.6. For versions prior to 3.13.1, update to version 3.13.1.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-5815

Affected Products

Github Enterprise Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-5815 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5815 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1 · Note
• https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.12.6 · Note
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.9.17 · Note
• https://t.me/cvedetector/1022 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.11.12 · Note
• https://t.me/cvenotify/94943 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.10.14 · Note