XSS Vulnerability in GitHub Enterprise Server Requires Immediate Action

CVE-2024-8770

6.1MEDIUM

Key Information

Vendor: GitHub
Status: Enterprise Server
Vendor: CVE Published:; 23 September 2024

Summary

A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

Refferences

https://docs.github.com/en/[email protected]/admin/r...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Sep 23, 2024

Collectors

NVD Database