CVE-2024-5746: SSRF
First published: Thu Jun 20 2024(Updated: )
A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise | <3.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5
Frequently Asked Questions
What is the severity of CVE-2024-5746?
CVE-2024-5746 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-5746?
To fix CVE-2024-5746, upgrade to GitHub Enterprise Server version 3.14 or later.
Who is affected by CVE-2024-5746?
CVE-2024-5746 affects GitHub Enterprise Server versions up to and including 3.13.
What are the risks associated with CVE-2024-5746?
The main risk associated with CVE-2024-5746 is that an attacker with Site Administrator privileges could execute arbitrary code on the server.
Can CVE-2024-5746 be exploited remotely?
CVE-2024-5746 requires authenticated access, meaning an attacker must have a valid Site Administrator account to exploit it.
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/github
- canonical/github enterprise