PT-2024-39274 · Github · Github Enterprise Server

Ahacker1 · Published 2024-11-07 · Updated 2025-08-27 · CVE-2024-8810

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:C/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14.1 GitHub Enterprise Server versions 3.13.4 and earlier GitHub Enterprise Server versions 3.12.9 and earlier GitHub Enterprise Server versions 3.11.15 and earlier GitHub Enterprise Server versions 3.10.17 and earlier

Description: A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This issue was reported via the GitHub Bug Bounty program.

Recommendations: For GitHub Enterprise Server versions prior to 3.14.1, update to version 3.14.1 or later. For GitHub Enterprise Server versions prior to 3.13.4, update to version 3.13.4 or later. For GitHub Enterprise Server versions prior to 3.12.9, update to version 3.12.9 or later. For GitHub Enterprise Server versions prior to 3.11.15, update to version 3.11.15 or later. For GitHub Enterprise Server versions prior to 3.10.17, update to version 3.10.17 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-8810

Affected Products

Github Enterprise Server

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-8810 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8810 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.15 · Note
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.1 · Note
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.9 · Note
• https://twitter.com/VulmonFeeds/status/1854701056074121289 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.4 · Note
• https://t.me/cveNotify/133722 · Telegram Post
• https://twitter.com/CveFindCom/status/1854645300817809615 · Twitter Post
• https://twitter.com/transilienceai/status/1855839256045875503 · Twitter Post
• https://twitter.com/transilienceai/status/1855839275943608669 · Twitter Post
• https://t.me/cvedetector/10139 · Telegram Post
• https://twitter.com/CCBalert/status/1854909023209873762 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.17 · Note
• https://twitter.com/CVEnew/status/1854637217437589737 · Twitter Post