Lucene search

K
cvelistGitHub_PCVELIST:CVE-2024-1082
HistoryFeb 13, 2024 - 6:47 p.m.

CVE-2024-1082 Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload

2024-02-1318:47:10
CWE-22
GitHub_P
www.cve.org
github
enterprise server
path traversal
vulnerability
cve-2024-1082
unauthorized access
symbolic links
github pages
artifact
upload
bug bounty program

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

15.5%

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed anΒ attacker to gain unauthorized read permission to files by deploying arbitrary symbolic links to a GitHub Pages site with a specially crafted artifact tarball. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.15, 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.8.15",
            "status": "unaffected"
          }
        ],
        "lessThan": "3.8.15",
        "status": "affected",
        "version": "3.8.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.9.10",
            "status": "unaffected"
          }
        ],
        "lessThan": "3.9.10",
        "status": "affected",
        "version": "3.9.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.10.7",
            "status": "unaffected"
          }
        ],
        "lessThan": "3.10.7",
        "status": "affected",
        "version": "3.10.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.11.5",
            "status": "unaffected"
          }
        ],
        "lessThan": "3.11.5",
        "status": "affected",
        "version": "3.11.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "3.12"
      }
    ]
  }
]

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

15.5%

Related for CVELIST:CVE-2024-1082