Lucene search

K
cvelistGitHub_PCVELIST:CVE-2024-2469
HistoryMar 20, 2024 - 10:56 p.m.

CVE-2024-2469 Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance

2024-03-2022:56:03
CWE-20
GitHub_P
www.cve.org
vulnerability
github
remote code execution
ssh access
administrator role
github bug bounty program

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

15.7%

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution.Β This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.8.17",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.8.16",
        "status": "affected",
        "version": "3.8.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.9.12",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.9.11",
        "status": "affected",
        "version": "3.9.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.10.9",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.10.8",
        "status": "affected",
        "version": "3.10.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.11.7",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.11.6",
        "status": "affected",
        "version": "3.11.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.12.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.12.0",
        "status": "affected",
        "version": "3.12",
        "versionType": "semver"
      }
    ]
  }
]

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

15.7%

Related for CVELIST:CVE-2024-2469