CVE-2024-0507CWE-20

Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

Medium · published January 16, 2024

Patch now

High probability of exploitation

CVSS calls it medium at 6.5. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1
6.5
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.65800 · 99.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-01-16T18:51Z
EPSS history
Timeline
  • 16 JAN 18:51Z
    Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server
    cvelistv5