PT-2024-6123 · Github · Github Enterprise Server

Vaibhav Singh · Published 2024-08-20 · Updated 2024-09-27 · CVE-2024-6337

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14 GitHub Enterprise Server version 3.13.3 GitHub Enterprise Server version 3.12.8 GitHub Enterprise Server version 3.11.14 GitHub Enterprise Server version 3.10.16

Description An Incorrect Authorization issue was identified in GitHub Enterprise Server, allowing a GitHub App with limited permissions to read issue content inside a private repository. This was only exploitable via user access token, and installation access token was not impacted. The issue was reported via the GitHub Bug Bounty program and has been exploited in real-world attacks.

Recommendations For GitHub Enterprise Server versions prior to 3.14, update to version 3.13.3, 3.12.8, 3.11.14, or 3.10.16 to resolve the issue. As a temporary workaround, consider restricting access to private repositories for GitHub Apps with content: read and pull request write: write permissions until the update is applied. Avoid using user access tokens for GitHub Apps with limited permissions in private repositories until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-07037

CVE-2024-6337

Affected Products

Github Enterprise Server

References · 18

• https://bdu.fstec.ru/vul/2024-07037 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6337 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6337 · Security Note
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8 · Vendor Advisory
• https://twitter.com/CVEnew/status/1825980643727061396 · Twitter Post
• https://twitter.com/fletch_ai/status/1826499746606780667 · Twitter Post
• https://twitter.com/transilienceai/status/1828866814647939503 · Twitter Post
• https://twitter.com/qualys/status/1826290313771499613 · Twitter Post
• https://t.me/cvenotify/96395 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1826028503923409258 · Twitter Post
• https://twitter.com/transilienceai/status/1827044794708664636 · Twitter Post
• https://t.me/true_secator/6127 · Telegram Post