CVE-2024-8263CWE-269

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags

Medium · published September 23, 2024

CVSS v4.0
6.2
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v4.0
6.2 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N
EPSS
0.00449 · 38.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-09-23T20:12Z
EPSS history
Timeline
  • 23 SEP 20:12Z
    An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags
    cvelistv5