CVE-2024-1908: Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1908?
The severity of CVE-2024-1908 is classified as critical due to its potential impact on private repository data.
How do I fix CVE-2024-1908?
To fix CVE-2024-1908, upgrade GitHub Enterprise Server to version 3.13 or higher.
Who is affected by CVE-2024-1908?
CVE-2024-1908 affects GitHub Enterprise Server instances running version 3.12 or earlier.
What kind of attacks are possible with CVE-2024-1908?
An attacker can exploit CVE-2024-1908 to access private repository data using the Enterprise Actions GitHub Connect download token.
Is there a workaround for CVE-2024-1908?
Currently, there are no confirmed workarounds for CVE-2024-1908; updating to the latest version is the recommended action.