CVE-2024-5815CWE-352

Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository

Medium · published July 16, 2024

CVSS v4.0
6.8
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. A mitigating factor is that the attacker would have to be a trusted GitHub Enterprise Server user, and the victim would have to visit a tag in the attacker's fork of their own repository. vulnerability affected all versions of GitHub Enterprise Server prior 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17.

This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/S:N/AU:N/R:U/RE:L/U:Amber
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-07-16T21:26Z
EPSS history
Timeline
  • 16 JUL 21:26Z
    Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository
    cvelistv5