Lucene search

GitHub_PCVE-2024-6800

HistoryAug 20, 2024 - 8:15 p.m.

CVE-2024-6800

2024-08-2020:15:09

CWE-347

GitHub_P

web.nvd.nist.gov

github enterprise server

saml authentication

identity providers

network access

saml response

site administrator privileges

unauthorized access

bug bounty program

CVSS4

9.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:L/SA:L/U:Red/R:U/V:C/RE:H

AI Score

6.7

Confidence

Low

EPSS

Percentile

16.4%

JSON

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.

Affected configurations

Vulners

Vulnrichment

Node

githubenterprise_serverRange3.13.0–3.13.2

githubenterprise_serverRange3.12.0–3.12.7

githubenterprise_serverRange3.11.0–3.11.13

githubenterprise_serverRange3.10.0–3.10.15

VendorProductVersionCPE
githubenterprise_server*cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
github	enterprise_server	*	cpe:2.3:a:github:enterprise_server::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "GitHub Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.13.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.13.2",
        "status": "affected",
        "version": "3.13.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.12.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.12.7",
        "status": "affected",
        "version": "3.12.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.11.14",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.11.13",
        "status": "affected",
        "version": "3.11.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.10.16",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.10.15",
        "status": "affected",
        "version": "3.10.0",
        "versionType": "semver"
      }
    ]
  }
]

References

docs.github.com/en/[email protected]/admin/release-notes#3.10.16

docs.github.com/en/[email protected]/admin/release-notes#3.11.14

docs.github.com/en/[email protected]/admin/release-notes#3.12.8

docs.github.com/en/[email protected]/admin/release-notes#3.13.3

Social References

CVSS4

9.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:L/SA:L/U:Red/R:U/V:C/RE:H

AI Score

6.7

Confidence

Low

EPSS

Percentile

16.4%

JSON

Related for CVE-2024-6800