CVE-2024-2469CWE-20

Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance

High · published March 20, 2024

CVSS v3.1
8.0
EPSS
2%
Percentile
75.8
In the wild
Unconfirmed
What it is

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01616 · 75.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-03-20T22:56Z
EPSS history
Timeline
  • 20 MAR 22:56Z
    Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance
    cvelistv5