Skip to content
OpenAdvisories
Medium WID-SEC-2024-0128 3 CVEs

Microsoft GitHub Enterprise: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Jan 16, 2024 · de-DE

Vendor: Microsoft Product: GitHub Enterprise Product: GitHub Enterprise < 3.10.5 Product: GitHub Enterprise < 3.11.3 Product: GitHub Enterprise < 3.8.13 Product: GitHub Enterprise < 3.9.8 Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Programmcode auszuführen oder seine Privilegien zu erweitern.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 3

  • High 7.2
    CVE-2024-0200 Scanner template EPSS 72%

    Unsafe Reflection in Github Enterprise Server leading to Command Injection

    An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would nee…

    GitHub Enterprise Server
  • Medium 6.5
    CVE-2024-0507 Public exploit EPSS 66%

    Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

    An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed…

    GitHub Enterprise Server
  • Unscored —
    CVE-2023-51381 Rejected

    This CVE ID has been rejected or withdrawn by GitHub.

Revision history

  1. #1

    Initiale Fassung

References