GitHub_PCVELIST:CVE-2024-0507CVE-2024-0507 Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
25.0%
An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Enterprise Server",
"vendor": "GitHub",
"versions": [
{
"lessThanOrEqual": "3.8.12",
"status": "affected",
"version": "3.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.9.7",
"status": "affected",
"version": "3.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.10.4",
"status": "affected",
"version": "3.10.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.11.2",
"status": "affected",
"version": "3.11.0",
"versionType": "semver"
}
]
}
]Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
25.0%