Summary
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder Dateien zu manipulieren.
Product
GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.
Vulnerabilities 4
-
High 8.0
Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerabil…
-
High 8.0
Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console
A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. E…
-
Medium 5.9
Repository administrator can bypass organization's ruleset using deploy keys
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for …
-
Medium 5.5
Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions
A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of …
Revision history
-
#1
Initiale Fassung
References
-
Release Notes Enterprise Server 3.10.10 vom 2024-04-21
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10
-
Release Notes Enterprise Server 3.11.8 vom 2024-04-21
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8
-
Release Notes Enterprise Server 3.10.10 vom 2024-04-21
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
-
Release Notes Enterprise Server 3.10.10 vom 2024-04-21
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13
-
GitHub Advisory Database vom 2024-04-21
https://github.com/advisories/GHSA-4325-9qm2-3cg2
-
GitHub Advisory Database vom 2024-04-21
https://github.com/advisories/GHSA-mvg6-43mv-76rp