PT-2024-7223 · Github · Github Enterprise Server

Păun Luca · Published 2024-10-04 · Updated 2024-11-15 · CVE-2024-9539

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14 GitHub Enterprise Server version 3.14.2 GitHub Enterprise Server version 3.13.5 GitHub Enterprise Server version 3.12.10 GitHub Enterprise Server version 3.11.16

Description An information disclosure issue was identified in GitHub Enterprise Server via an attacker-uploaded asset URL, allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to upload malicious SVG files and phish a victim user to click on that uploaded asset URL.

Recommendations For GitHub Enterprise Server versions prior to 3.14, update to version 3.14.2, 3.13.5, 3.12.10, or 3.11.16 to resolve the issue. As a temporary workaround, consider restricting access to the uploaded asset URL to minimize the risk of exploitation. Avoid using malicious SVG files in the affected GitHub Enterprise Server until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-08562

CVE-2024-9539

Affected Products

Github Enterprise Server

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-9539 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9539 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08562 · Security Note
• https://t.me/cvenotify/97895 · Telegram Post
• https://twitter.com/UndercodeNews/status/1857514824978325690 · Twitter Post
• https://vuldb.com/?id.280130 · Note
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10 · Note
• https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.5 · Note
• https://twitter.com/transilienceai/status/1855839275943608669 · Twitter Post
• https://twitter.com/Eth1calHackrZ/status/1847038630050803794 · Twitter Post
• https://t.me/cvedetector/7723 · Telegram Post
• https://twitter.com/transilienceai/status/1855839256045875503 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16 · Note
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.2 · Note
• https://t.me/true_secator/6325 · Telegram Post