CVE-2024-1908: Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation
First published: Thu Feb 29 2024(Updated: )
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise | <3.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes/#3.8.16
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes/#3.9.11
- https://https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.8
- https://https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16
Frequently Asked Questions
What is the severity of CVE-2024-1908?
The severity of CVE-2024-1908 is classified as critical due to its potential impact on private repository data.
How do I fix CVE-2024-1908?
To fix CVE-2024-1908, upgrade GitHub Enterprise Server to version 3.13 or higher.
Who is affected by CVE-2024-1908?
CVE-2024-1908 affects GitHub Enterprise Server instances running version 3.12 or earlier.
What kind of attacks are possible with CVE-2024-1908?
An attacker can exploit CVE-2024-1908 to access private repository data using the Enterprise Actions GitHub Connect download token.
Is there a workaround for CVE-2024-1908?
Currently, there are no confirmed workarounds for CVE-2024-1908; updating to the latest version is the recommended action.
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/github
- canonical/github enterprise