CVE-2024-8770
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.8epss 0.4%
exploitation probability
0.4%top 72% of all CVEs
observed exploitation
nono source reports it
A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N
Affected products
GitHub · GitHub Enterprise ServerReferences
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.17https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.15https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.9https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.4https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.1