XSS Vulnerability in GitHub Enterprise Server Requires Immediate Action
CVE-2024-8770

6.1MEDIUM

Key Information:

Vendor
GitHub
Status
Enterprise Server
Vendor
CVE Published:
23 September 2024

Summary

A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

References

https://docs.github.com/en/[email protected]/admin/r...
https://docs.github.com/en/[email protected]/admin/r...
https://docs.github.com/en/[email protected]/admin/r...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.