CVE-2024-6395: GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys
First published: Tue Jul 16 2024(Updated: )
An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise | >=3.9.0<3.9.17 | |
| GitHub Enterprise | >=3.10.0<3.10.14 | |
| GitHub Enterprise | >=3.11.0<3.11.12 | |
| GitHub Enterprise | >=3.12.0<3.12.6 | |
| GitHub Enterprise | =3.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://help.github.com/enterprise-server@3.10/admin/release-notes#3.10.15
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17
Frequently Asked Questions
What is the severity of CVE-2024-6395?
CVE-2024-6395 is classified as a vulnerability that allows information exposure but does not compromise repository content.
How do I fix CVE-2024-6395?
To mitigate CVE-2024-6395, upgrade your GitHub Enterprise Server to version 3.10.15 or later, or to the latest version available.
Which versions of GitHub Enterprise Server are affected by CVE-2024-6395?
CVE-2024-6395 affects GitHub Enterprise Server versions from 3.9.0 to 3.9.17, from 3.10.0 to 3.10.14, from 3.11.0 to 3.11.12, from 3.12.0 to 3.12.6, and the exact version 3.13.0.
What type of information can be leaked due to CVE-2024-6395?
CVE-2024-6395 allows an attacker to enumerate the names of private repositories utilizing deploy keys.
Does CVE-2024-6395 allow unauthorized access to repository contents?
No, CVE-2024-6395 only exposes the repository names and does not allow access to the actual content.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/github
- canonical/github enterprise
- version/github enterprise/3.9.0
- version/github enterprise/3.10.0
- version/github enterprise/3.11.0
- version/github enterprise/3.12.0
- version/github enterprise/3.13.0