CVE-2024-6337

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access token was not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14 and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*

History

27 Sep 2024, 17:48

Type Values Removed Values Added
CPE cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
References () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16 - () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14 - () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8 - () https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3 - () https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3 - Release Notes, Vendor Advisory
First Time Github
Github enterprise Server
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.5

21 Aug 2024, 12:30

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-20 20:15

Updated : 2024-09-27 17:48


NVD link : CVE-2024-6337

Mitre link : CVE-2024-6337

CVE.ORG link : CVE-2024-6337


JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-863

Incorrect Authorization