CVE-2024-1482: Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution
First published: Wed Feb 14 2024(Updated: )
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | >3.8<=3.12 | |
| GitHub Enterprise Server | >=3.8.0<3.9.10 | |
| GitHub Enterprise Server | >=3.10.0<3.10.7 | |
| GitHub Enterprise Server | >=3.11.0<3.11.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1482?
CVE-2024-1482 is classified as a high severity vulnerability due to the potential for unauthorized branch creation and execution of GitHub Actions.
How do I fix CVE-2024-1482?
To fix CVE-2024-1482, upgrade your GitHub Enterprise Server to versions 3.9.10, 3.10.7, or 3.11.5, which contain the necessary patches.
What versions of GitHub Enterprise Server are affected by CVE-2024-1482?
CVE-2024-1482 affects GitHub Enterprise Server versions between 3.8.0 and 3.12 inclusive, specifically 3.8 to 3.11.x.
What type of attack is possible due to CVE-2024-1482?
An attacker can exploit CVE-2024-1482 to create new branches in public repositories and execute arbitrary workflows with compromised GITHUB_TOKEN permissions.
Is CVE-2024-1482 a remote or local vulnerability?
CVE-2024-1482 is considered a remote vulnerability, as it can be exploited without physical access to the affected system.
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/github
- canonical/github enterprise server
- version/github enterprise server/3.8.0
- version/github enterprise server/3.10.0
- version/github enterprise server/3.11.0