CVE-2024-8810
Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access
A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17. This vulnerability was reported via the GitHub Bug Bounty program.
Reserved 2024-09-13 | Published 2024-11-07 | Updated 2024-11-08 | Assigner GitHub_PCWE-269 Improper Privilege Management
ahacker1
docs.github.com/...nterprise-server@3.10/admin/release-notes
docs.github.com/...nterprise-server@3.11/admin/release-notes
docs.github.com/...nterprise-server@3.12/admin/release-notes
docs.github.com/...nterprise-server@3.13/admin/release-notes
docs.github.com/...nterprise-server@3.14/admin/release-notes
Support options
