CVE-2024-7711

2024-08-2019:17:37

CWE-863

GitHub_P

www.cve.org

github

authorization

vulnerability

public repository

bug bounty program

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:L/VI:L/SI:L/VA:N/SA:N/S:N/AU:Y/U:Amber/R:U/V:D/RE:L

EPSS

Percentile

16.4%

JSON

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3.12.8, and 3.11.14. Versions 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "GitHub Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.11.14",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.11.13",
        "status": "affected",
        "version": "3.11.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.12.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.12.7",
        "status": "affected",
        "version": "3.12.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.13.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.13.2",
        "status": "affected",
        "version": "3.13.0",
        "versionType": "semver"
      }
    ]
  }
]