This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitHub Enterprise Server fixes 2 vulnerabilities

GitHub versions 3.8.13, 3.9.8, 3.10.5 and 3.11.3 fix 2 vulnerabilities in the GitHub Enterprise Server product.

GitHub Enterprise Server - RCE (CVE-2024-0200)
CVSS 7.2 (High)

An authenticated remote attacker can execute code on a vulnerable instance. To exploit the vulnerability, the attacker must be logged in to the GHES instance with organization owner permissions [1]. Impact: Malicious code execution

The vulnerability is present in product:

  • <3.8.13, <3.9.8, <3.10.5, <3.11.3

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

More information:

The vulnerability was publicly disclosed 16. 1. 2024. This report was last updated 23. 1. 2024.

GitHub Enterprise Server - privilege escalation (CVE-2024-0507)
CVSS 8.8 (High)

An authenticated remote attacker with editor permissions can perform privilege escalation via a command injection attack in the management console [2]. Impact: Unauthorized access to the system

The vulnerability is present in product:

  • <3.8.13, <3.9.8, <3.10.5, <3.11.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 1. 2024. This report was last updated 23. 1. 2024.

By CESNET, z.s.p.o. Martin Krajči on 24. 1. 2024.

CESNET, z.s.p.o. Logo