Command injection

2024-01-1619:15:00

PRIOn knowledge base

www.prio-n.com

command injection

management console

github enterprise

privilege escalation

bug bounty program

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.0%

JSON

An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program.

CPENameOperatorVersion
enterprise_serverge3.11.0
enterprise_serverlt3.11.3
enterprise_serverge3.10.0
enterprise_serverlt3.10.5
enterprise_serverge3.9.0
enterprise_serverlt3.9.8
enterprise_serverlt3.8.13

Name	Operator	Version
enterprise_server	ge	3.11.0
enterprise_server	lt	3.11.3
enterprise_server	ge	3.10.0
enterprise_server	lt	3.10.5
enterprise_server	ge	3.9.0
enterprise_server	lt	3.9.8
enterprise_server	lt	3.8.13

References

docs.github.com/en/[email protected]/admin/release-notes