CVE-2024-9487: An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled
First published: Thu Oct 10 2024(Updated: )
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | <3.11.16 | |
| GitHub Enterprise Server | >=3.12.0<3.12.10 | |
| GitHub Enterprise Server | >=3.13.0<3.13.5 | |
| GitHub Enterprise Server | >=3.14.0<3.14.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.5
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.2
Frequently Asked Questions
What is the severity of CVE-2024-9487?
CVE-2024-9487 is classified as a high severity vulnerability due to its potential to bypass SAML SSO authentication.
How do I fix CVE-2024-9487?
To fix CVE-2024-9487, upgrade GitHub Enterprise Server to a version higher than 3.11.16, 3.12.10, 3.13.5, or 3.14.2, depending on your current version.
What type of vulnerability is CVE-2024-9487?
CVE-2024-9487 is an improper verification of cryptographic signature vulnerability.
What are the impacts of CVE-2024-9487?
The exploitation of CVE-2024-9487 could result in unauthorized provisioning of users and access to the GitHub Enterprise Server instance.
Which versions of GitHub Enterprise Server are affected by CVE-2024-9487?
CVE-2024-9487 affects GitHub Enterprise Server versions prior to 3.11.16, 3.12.10, 3.13.5, and 3.14.2.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/event
- agent/trending
- agent/tags
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- vendor/github
- canonical/github enterprise server
- version/github enterprise server/3.12.0
- version/github enterprise server/3.13.0
- version/github enterprise server/3.14.0