GitHub_PVULNRICHMENT:CVE-2024-7711CVE-2024-7711
CVSS4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:L/VI:L/SI:L/VA:N/SA:N/S:N/AU:Y/U:Amber/R:U/V:D/RE:L
AI Score
Confidence
High
EPSS
Percentile
16.4%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3.12.8, and 3.11.14. Versions 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program.
CNA Affected
[
{
"vendor": "GitHub",
"product": "GitHub Enterprise Server",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "3.11.14",
"status": "unaffected"
}
],
"version": "3.11.0",
"versionType": "semver",
"lessThanOrEqual": "3.11.13"
},
{
"status": "affected",
"changes": [
{
"at": "3.12.8",
"status": "unaffected"
}
],
"version": "3.12.0",
"versionType": "semver",
"lessThanOrEqual": "3.12.7"
},
{
"status": "affected",
"changes": [
{
"at": "3.13.3",
"status": "unaffected"
}
],
"version": "3.13.0",
"versionType": "semver",
"lessThanOrEqual": "3.13.2"
}
],
"defaultStatus": "affected"
}
]Related
CVSS4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:L/VI:L/SI:L/VA:N/SA:N/S:N/AU:Y/U:Amber/R:U/V:D/RE:L
AI Score
Confidence
High
EPSS
Percentile
16.4%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial