CVE-2024-2440
A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached.
Does this matter?
Lower severity and a low EPSS score (0.45%). Track it; it rarely justifies an emergency change on its own.
Description
A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-367
- Affected
- github/enterprise server
- Source
- product-cna@github.com
References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10Release Notes
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8Release Notes
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2Release Notes
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13Release Notes
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10Release Notes
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8Release Notes
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2Release Notes
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.