Lucene search

K
vulnrichmentGitHub_PVULNRICHMENT:CVE-2024-2469
HistoryMar 20, 2024 - 10:56 p.m.

CVE-2024-2469 Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance

2024-03-2022:56:03
CWE-20
GitHub_P
github.com
3
cve-2024-2469
remote code execution
github enterprise server
ssh access
administrator role
version 3.8.0
bug bounty program

CVSS3

8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution.Β This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:github:enterprise_server:-:*:*:*:*:*:*:*"
    ],
    "vendor": "github",
    "product": "enterprise_server",
    "versions": [
      {
        "status": "affected",
        "version": "3.8.0",
        "versionType": "custom",
        "lessThanOrEqual": "3.8.16"
      },
      {
        "status": "affected",
        "version": "3.9.0",
        "versionType": "custom",
        "lessThanOrEqual": "3.9.11"
      },
      {
        "status": "affected",
        "version": "3.10.0",
        "versionType": "custom",
        "lessThanOrEqual": "3.10.8"
      },
      {
        "status": "affected",
        "version": "3.11.0",
        "versionType": "custom",
        "lessThanOrEqual": "3.11.6"
      },
      {
        "status": "affected",
        "version": "3.12",
        "versionType": "custom",
        "lessThanOrEqual": "3.12.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

CVSS3

8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2024-2469