CVE-2024-8810highCWE-269

CVE-2024-8810: falha de alta gravidade em GitHub Enterprise Server

Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Enterprise Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:C/RE:L/U:Amber
Produtos afetados
GitHub · Enterprise Server
CVEs relacionadas — GitHub Enterprise Server

No mesmo produto, das mais perigosas para as menos.

CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%CVE-2026-3854HIGHRemote code execution via git push option injection in GitHub Enterprise ServerEPSS 41.9%CVE-2024-9487CRITICALAn Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabledEPSS 25.6%CVE-2026-9312CRITICALServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpointEPSS 9.2%CVE-2024-1374CRITICALCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement ConsoleEPSS 2.6%