Lucene search

Ahacker1H1:2501036

HistoryMay 11, 2024 - 3:04 a.m.

GitHub: Access body and title of Internal Repo Issues in Projects

2024-05-1103:04:37

ahacker1

hackerone.com

$4000

github enterprise server

internal repositories

authorization vulnerability

github projects

cve-2024-5817

bug bounty

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/SC:L/VI:N/SI:N/VA:N/SA:N/U:Amber

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was only exploitable in internal repositories and required the attacker to have access to the corresponding project board. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17.

CVE-2024-5817

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/SC:L/VI:N/SI:N/VA:N/SA:N/U:Amber

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Related for H1:2501036