CVE-2024-1482: Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUBTOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.9.10 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.10.7 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.11.5
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1482?
CVE-2024-1482 is classified as a high severity vulnerability due to the potential for unauthorized branch creation and execution of GitHub Actions.
How do I fix CVE-2024-1482?
To fix CVE-2024-1482, upgrade your GitHub Enterprise Server to versions 3.9.10, 3.10.7, or 3.11.5, which contain the necessary patches.
What versions of GitHub Enterprise Server are affected by CVE-2024-1482?
CVE-2024-1482 affects GitHub Enterprise Server versions between 3.8.0 and 3.12 inclusive, specifically 3.8 to 3.11.x.
What type of attack is possible due to CVE-2024-1482?
An attacker can exploit CVE-2024-1482 to create new branches in public repositories and execute arbitrary workflows with compromised GITHUB_TOKEN permissions.
Is CVE-2024-1482 a remote or local vulnerability?
CVE-2024-1482 is considered a remote vulnerability, as it can be exploited without physical access to the affected system.