CVE-2024-8810
Nov. 8, 2024, 7:01 p.m.
Tags
Product(s) Impacted
GitHub Enterprise Server
- before 3.10.17
Description
A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17. This vulnerability was reported via the GitHub Bug Bounty program.
Weaknesses
CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE ID: 269Date
Published: Nov. 7, 2024, 10:15 p.m.
Last Modified: Nov. 8, 2024, 7:01 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
product-cna@github.com