CVE-2024-5746

Katalog CVE

CVSS 7.2 · High EPSS 0,86%

Kerentanan Server-Side Request Forgery (SSRF) pada github enterprise server. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.

Rincian

Terbit di NVD

20 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13 release notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11 release notes
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5 release notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16 release notes