CVE-2024-3646

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.12 GitHub Enterprise Server version 3.12 through 3.12.1 GitHub Enterprise Server version 3.11 through 3.11.7 GitHub Enterprise Server version 3.10 through 3.10.9 GitHub Enterprise Server version 3.9 through 3.9.12

Description A command injection issue was identified in GitHub Enterprise Server, allowing an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this issue required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This issue was reported via the GitHub Bug Bounty program.

Recommendations For GitHub Enterprise Server versions prior to 3.9.13, update to version 3.9.13. For GitHub Enterprise Server versions 3.10 through 3.10.9, update to version 3.10.10. For GitHub Enterprise Server versions 3.11 through 3.11.7, update to version 3.11.8. For GitHub Enterprise Server versions 3.12 through 3.12.1, update to version 3.12.2.