Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft GitHub Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Product
GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.
Vulnerabilities 1
-
Critical 9.5CVE-2024-9487 EPSS 26%
An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required …
Revision history
-
#1
Initiale Fassung
References
-
NIST Vulnerability Database vom 2024-10-14
https://nvd.nist.gov/vuln/detail/CVE-2024-9487
-
GitHub Release Notes vom 2024-10-14
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.2
-
GitHub Release Notes vom 2024-10-14
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.5
-
GitHub Release Notes vom 2024-10-14
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10
-
GitHub Release Notes vom 2024-10-14
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10