CVE-2024-8810CWE-269

Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access

High · published November 7, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:C/RE:L/U:Amber
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-11-07T21:24Z
EPSS history
Timeline
  • 07 NOV 21:24Z
    Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access
    cvelistv5