CVE-2024-0200CWE-470

Unsafe Reflection in Github Enterprise Server leading to Command Injection

High · published January 16, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.2. It sits in the 99.4th percentile for exploit probability.

CVSS v3.1
7.2
EPSS
72%
Percentile
99.4
In the wild
Unconfirmed
What it is

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.71725 · 99.4th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2024-01-16T18:50Z
EPSS history
Timeline
  • 16 JAN 18:50Z
    Unsafe Reflection in Github Enterprise Server leading to Command Injection
    cvelistv5