This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitHub Enterprise Server fixes a critical vulnerability
GitHub Enterprise Server fixes a critical vulnerability allowing authentication bypass. The fix was released in versions 3.9.15 [1], 3.10.12 [2], 3.11.10 [3] and 3.12.4 [4].
On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an unauthenticated remote attacker can forge a SAML response and thereby gain access to a user with site administrator privileges. Exploiting this vulnerability would allow the attacker unauthorized access to the instance without prior authentication [5].
The vulnerability is present in product:
- GitHub Enterprise Server; < 3.9.15; >=3.10.0, < 3.10.12; >=3.11.0, < 3.11.10; >=3.12.0, < 3.12.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-4985 at cve.org, NVD
- CWE-303 at cwe.mitre.org
The vulnerability was publicly disclosed 20. 5. 2024.
Links
- [1] https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.15
- [2] https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.12
- [3] https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10
- [4] https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.4
- [5] https://nvd.nist.gov/vuln/detail/CVE-2024-4985
By CESNET, z.s.p.o. Michaela Jarošová on 27. 5. 2024.