PT-2024-39274
CVE-2024-8810
·
تاريخ النشر
2024-11-07
·
تاريخ التحديث
2025-08-27
الوصف من
CVSS 4.0
8.7
عاليةالمقاييسAV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:C/RE:L/U:Amber
Name of the Vulnerable Software and Affected Versions:
GitHub Enterprise Server versions prior to 3.14.1
GitHub Enterprise Server versions 3.13.4 and earlier
GitHub Enterprise Server versions 3.12.9 and earlier
GitHub Enterprise Server versions 3.11.15 and earlier
GitHub Enterprise Server versions 3.10.17 and earlier
Description:
A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This issue was reported via the GitHub Bug Bounty program.
Recommendations:
For GitHub Enterprise Server versions prior to 3.14.1, update to version 3.14.1 or later.
For GitHub Enterprise Server versions prior to 3.13.4, update to version 3.13.4 or later.
For GitHub Enterprise Server versions prior to 3.12.9, update to version 3.12.9 or later.
For GitHub Enterprise Server versions prior to 3.11.15, update to version 3.11.15 or later.
For GitHub Enterprise Server versions prior to 3.10.17, update to version 3.10.17 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾