CVE-2024-8810
Published: Nov 7, 2024
Modified: Nov 8, 2024
Description
A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17. This vulnerability was reported via the GitHub Bug Bounty program.
| Vendor | Product | Versions |
|---|---|---|
GitHub | Enterprise Server | affected 3.10.0 - <= 3.10.16affected 3.11.0 - <= 3.11.14affected 3.12.0 - <= 3.12.8affected 3.13.0 - <= 3.13.3affected 3.14 - <= 3.14.0 |
Weaknesses (CWE)
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now