Incorrect Authorization Vulnerability in GitHub Enterprise Server

CVE-2024-7711

Summary

An Incorrect Authorization vulnerability has been discovered in GitHub Enterprise Server, which allows attackers to modify issue titles, assignees, and labels within any public repository. This loophole was limited to public repositories and poses significant risks if exploited. The vulnerability impacts GitHub Enterprise Server versions prior to 3.14, with remediation provided in versions 3.13.3, 3.12.8, and 3.11.14. Notably, version 3.10 is not affected by this vulnerability. The issue was identified through the GitHub Bug Bounty program, highlighting the importance of prompt security assessments.

References