CVE-2024-2440CWE-367

Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions

Medium · published April 19, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2024-04-19T17:02Z
EPSS history
Timeline
  • 19 APR 17:02Z
    Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions
    cvelistv5