Incorrect Authorization Vulnerability in GitHub Enterprise Server Allows Arbitrary Actions with GITHUB_TOKEN

CVE-2024-1482

What is CVE-2024-1482?

An authorization flaw exists in GitHub Enterprise Server, allowing an unauthorized user to create new branches in public repositories and execute arbitrary workflows using permissions granted by the GITHUB_TOKEN. This vulnerability impacts all versions of GitHub Enterprise Server from 3.8 up to (but not including) 3.12. The security issue was reported through the GitHub Bug Bounty program and has been remediated in newer versions: 3.9.10, 3.10.7, and 3.11.5. Ensure systems are updated to protect against potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References