PT-2024-37592 · Github · Github Enterprise Server

Ahacker1 · Published 2024-07-16 · Updated 2024-09-17 · CVE-2024-6395

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:C/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14

Description An exposure of sensitive information issue in GitHub Enterprise Server allows an attacker to enumerate the names of private repositories that utilize deploy keys. This issue does not allow unauthorized access to any repository content besides the name. The issue was reported via the GitHub Bug Bounty program.

Recommendations For versions prior to 3.9.17, update to version 3.9.17. For versions prior to 3.10.14, update to version 3.10.14. For versions prior to 3.11.12, update to version 3.11.12. For versions prior to 3.12.6, update to version 3.12.6. For versions prior to 3.13.1, update to version 3.13.1. As a temporary workaround, consider restricting access to deploy keys until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-6395

Affected Products

Github Enterprise Server

References · 9

• https://osv.dev/vulnerability/CVE-2024-6395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6395 · Security Note
• https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1 · Note
• https://help.github.com/enterprise-server@3.10/admin/release-notes#3.10.15 · Note
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12 · Note
• https://t.me/cvenotify/94944 · Telegram Post
• https://t.me/cvedetector/1014 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17 · Note
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6 · Note