Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Product
GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.
Vulnerabilities 4
-
Critical 9.1
Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability…
-
High 8.0
Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance
An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3…
-
Medium 5.5
Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions
A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of …
-
Medium 4.3
CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user
A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affe…
Revision history
-
#2
Prüfung Produkteintragung
-
#1
Initiale Fassung
References
-
Enterprise Server 3.8 release notes vom 2024-03-20
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.1
-
GitHub Advisory Database vom 2024-03-20
https://github.com/advisories/GHSA-4c84-c2x6-wwjv
-
GitHub Advisory Database vom 2024-03-20
https://github.com/advisories/GHSA-v7f6-g4pv-2qgj
-
GitHub Advisory Database vom 2024-03-20
https://github.com/advisories/GHSA-2c64-xxfm-j63g