cvelistv5 - cve-2024-6336

CVE-2024-6336 (GCVE-0-2024-6336)

Vulnerability from cvelistv5 – Published: 2024-07-16 21:27 – Updated: 2024-08-01 21:33

Summary

A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:N/R:U/U:Amber

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server@3.10…
	https://docs.github.com/en/enterprise-server@3.11…
	https://docs.github.com/en/enterprise-server@3.12…
	https://docs.github.com/en/enterprise-server@3.13…
	https://docs.github.com/en/enterprise-server@3.9/…

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 3.10.0 , ≤ 3.10.13 (semver) Affected: 3.11.0 , ≤ 3.11.11 (semver) Affected: 3.12.0 , ≤ 3.12.5 (semver) Affected: 3.13 , ≤ 3.13.0 (semver) Affected: 3.9.0 , ≤ 3.9.16 (semver)

Credits

Omar El Latif Giovanni Guido Antonio Francesco Sardella Andrea Valenza

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6336",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T15:38:56.968094Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T15:39:07.466Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:33:05.420Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.10.14",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.10.13",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.11.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.11.11",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.12.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.12.5",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.13.1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.13.0",
              "status": "affected",
              "version": "3.13",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "3.9.17",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.9.16",
              "status": "affected",
              "version": "3.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Omar El Latif"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Giovanni Guido"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Antonio Francesco Sardella"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrea Valenza"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eA Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-212",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-212 Functionality Misuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:N/R:U/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T21:27:07.393Z",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2024-6336",
    "datePublished": "2024-07-16T21:27:07.393Z",
    "dateReserved": "2024-06-25T20:18:21.890Z",
    "dateUpdated": "2024-08-01T21:33:05.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.9.0\", \"versionEndExcluding\": \"3.9.17\", \"matchCriteriaId\": \"BAF7098F-C0C3-474E-8E01-E3252A3A4DB4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.10.0\", \"versionEndExcluding\": \"3.10.14\", \"matchCriteriaId\": \"976E8532-E4BE-4779-9E09-05FCD57F5EB0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.11.0\", \"versionEndExcluding\": \"3.11.12\", \"matchCriteriaId\": \"1A638319-C7A1-42F0-808E-84DF23F37734\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.12.0\", \"versionEndExcluding\": \"3.12.6\", \"matchCriteriaId\": \"EB39F351-9738-4228-B4C9-0A0E6A4CE97D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:3.13.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D9D3E81-23E5-4BD9-BC0F-D87CF0ED21FF\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de configuraci\\u00f3n incorrecta de seguridad en GitHub Enterprise Server permiti\\u00f3 la divulgaci\\u00f3n de informaci\\u00f3n confidencial a usuarios no autorizados en GitHub Enterprise Server mediante la explotaci\\u00f3n de la funci\\u00f3n de conjunto de reglas de la organizaci\\u00f3n. Este ataque requiri\\u00f3 que un miembro de la organizaci\\u00f3n cambiara expl\\u00edcitamente la visibilidad de un repositorio dependiente de privado a p\\u00fablico. Esta vulnerabilidad afect\\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.14 y se solucion\\u00f3 en las versiones 3.13.1, 3.12.6, 3.11.12, 3.10.14 y 3.9.17. Esta vulnerabilidad se inform\\u00f3 a trav\\u00e9s del programa GitHub Bug Bounty.\"}]",
      "id": "CVE-2024-6336",
      "lastModified": "2024-11-21T09:49:27.270",
      "metrics": "{\"cvssMetricV40\": [{\"source\": \"product-cna@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:X/U:Amber\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"ACTIVE\", \"vulnerableSystemConfidentiality\": \"HIGH\", \"vulnerableSystemIntegrity\": \"NONE\", \"vulnerableSystemAvailability\": \"NONE\", \"subsequentSystemConfidentiality\": \"HIGH\", \"subsequentSystemIntegrity\": \"NONE\", \"subsequentSystemAvailability\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"confidentialityRequirements\": \"NOT_DEFINED\", \"integrityRequirements\": \"NOT_DEFINED\", \"availabilityRequirements\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NOT_DEFINED\", \"modifiedAttackComplexity\": \"NOT_DEFINED\", \"modifiedAttackRequirements\": \"NOT_DEFINED\", \"modifiedPrivilegesRequired\": \"NOT_DEFINED\", \"modifiedUserInteraction\": \"NOT_DEFINED\", \"modifiedVulnerableSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedVulnerableSystemIntegrity\": \"NOT_DEFINED\", \"modifiedVulnerableSystemAvailability\": \"NOT_DEFINED\", \"modifiedSubsequentSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedSubsequentSystemIntegrity\": \"NOT_DEFINED\", \"modifiedSubsequentSystemAvailability\": \"NOT_DEFINED\", \"safety\": \"NEGLIGIBLE\", \"automatable\": \"NO\", \"recovery\": \"USER\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"AMBER\"}}], \"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-07-16T22:15:05.983",
      "references": "[{\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15\", \"source\": \"product-cna@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12\", \"source\": \"product-cna@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6\", \"source\": \"product-cna@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1\", \"source\": \"product-cna@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17\", \"source\": \"product-cna@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}]",
      "sourceIdentifier": "product-cna@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"product-cna@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-6336\",\"sourceIdentifier\":\"product-cna@github.com\",\"published\":\"2024-07-16T22:15:05.983\",\"lastModified\":\"2024-11-21T09:49:27.270\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de configuraci\u00f3n incorrecta de seguridad en GitHub Enterprise Server permiti\u00f3 la divulgaci\u00f3n de informaci\u00f3n confidencial a usuarios no autorizados en GitHub Enterprise Server mediante la explotaci\u00f3n de la funci\u00f3n de conjunto de reglas de la organizaci\u00f3n. Este ataque requiri\u00f3 que un miembro de la organizaci\u00f3n cambiara expl\u00edcitamente la visibilidad de un repositorio dependiente de privado a p\u00fablico. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.14 y se solucion\u00f3 en las versiones 3.13.1, 3.12.6, 3.11.12, 3.10.14 y 3.9.17. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:X/U:Amber\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NEGLIGIBLE\",\"Automatable\":\"NO\",\"Recovery\":\"USER\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"AMBER\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.9.0\",\"versionEndExcluding\":\"3.9.17\",\"matchCriteriaId\":\"BAF7098F-C0C3-474E-8E01-E3252A3A4DB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.0\",\"versionEndExcluding\":\"3.10.14\",\"matchCriteriaId\":\"976E8532-E4BE-4779-9E09-05FCD57F5EB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.11.0\",\"versionEndExcluding\":\"3.11.12\",\"matchCriteriaId\":\"1A638319-C7A1-42F0-808E-84DF23F37734\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12.0\",\"versionEndExcluding\":\"3.12.6\",\"matchCriteriaId\":\"EB39F351-9738-4228-B4C9-0A0E6A4CE97D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:3.13.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D9D3E81-23E5-4BD9-BC0F-D87CF0ED21FF\"}]}]}],\"references\":[{\"url\":\"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T21:33:05.420Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6336\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-17T15:38:56.968094Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-17T15:39:02.169Z\"}}], \"cna\": {\"title\": \"Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Omar El Latif\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Giovanni Guido\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Antonio Francesco Sardella\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Andrea Valenza\"}], \"impacts\": [{\"capecId\": \"CAPEC-212\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-212 Functionality Misuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NEGLIGIBLE\", \"version\": \"4.0\", \"Recovery\": \"USER\", \"baseScore\": 6.9, \"Automatable\": \"NO\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:N/R:U/U:Amber\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"GitHub\", \"product\": \"GitHub Enterprise Server\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"3.10.14\", \"status\": \"unaffected\"}], \"version\": \"3.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.10.13\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.11.12\", \"status\": \"unaffected\"}], \"version\": \"3.11.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.11.11\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.12.6\", \"status\": \"unaffected\"}], \"version\": \"3.12.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.12.5\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.13.1\", \"status\": \"unaffected\"}], \"version\": \"3.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.13.0\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.9.17\", \"status\": \"unaffected\"}], \"version\": \"3.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.9.16\"}], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: transparent;\\\"\u003eA Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"shortName\": \"GitHub_P\", \"dateUpdated\": \"2024-07-16T21:27:07.393Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-6336\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T21:33:05.420Z\", \"dateReserved\": \"2024-06-25T20:18:21.890Z\", \"assignerOrgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"datePublished\": \"2024-07-16T21:27:07.393Z\", \"assignerShortName\": \"GitHub_P\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-GCH4-6C9X-V2FR

Vulnerability from github – Published: 2024-07-17 00:32 – Updated: 2024-09-17 15:31

Details

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:N/R:U/U:Amber

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-6336"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-16T22:15:05Z",
    "severity": "MODERATE"
  },
  "details": "A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.",
  "id": "GHSA-gch4-6c9x-v2fr",
  "modified": "2024-09-17T15:31:23Z",
  "published": "2024-07-17T00:32:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6336"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:X/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

FKIE_CVE-2024-6336

Vulnerability from fkie_nvd - Published: 2024-07-16 22:15 - Updated: 2024-11-21 09:49

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

URL	Tags
product-cna@github.com	https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15	Release Notes
product-cna@github.com	https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12	Release Notes
product-cna@github.com	https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6	Release Notes
product-cna@github.com	https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1	Release Notes
product-cna@github.com	https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17	Release Notes

Impacted products

Vendor	Product	Version
github	enterprise_server	*
github	enterprise_server	*
github	enterprise_server	*
github	enterprise_server	*
github	enterprise_server	3.13.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAF7098F-C0C3-474E-8E01-E3252A3A4DB4",
              "versionEndExcluding": "3.9.17",
              "versionStartIncluding": "3.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "976E8532-E4BE-4779-9E09-05FCD57F5EB0",
              "versionEndExcluding": "3.10.14",
              "versionStartIncluding": "3.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A638319-C7A1-42F0-808E-84DF23F37734",
              "versionEndExcluding": "3.11.12",
              "versionStartIncluding": "3.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB39F351-9738-4228-B4C9-0A0E6A4CE97D",
              "versionEndExcluding": "3.12.6",
              "versionStartIncluding": "3.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:3.13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D9D3E81-23E5-4BD9-BC0F-D87CF0ED21FF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de configuraci\u00f3n incorrecta de seguridad en GitHub Enterprise Server permiti\u00f3 la divulgaci\u00f3n de informaci\u00f3n confidencial a usuarios no autorizados en GitHub Enterprise Server mediante la explotaci\u00f3n de la funci\u00f3n de conjunto de reglas de la organizaci\u00f3n. Este ataque requiri\u00f3 que un miembro de la organizaci\u00f3n cambiara expl\u00edcitamente la visibilidad de un repositorio dependiente de privado a p\u00fablico. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.14 y se solucion\u00f3 en las versiones 3.13.1, 3.12.6, 3.11.12, 3.10.14 y 3.9.17. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty."
    }
  ],
  "id": "CVE-2024-6336",
  "lastModified": "2024-11-21T09:49:27.270",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NO",
          "Recovery": "USER",
          "Safety": "NEGLIGIBLE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "AMBER",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:X/U:Amber",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "product-cna@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-07-16T22:15:05.983",
  "references": [
    {
      "source": "product-cna@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15"
    },
    {
      "source": "product-cna@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12"
    },
    {
      "source": "product-cna@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6"
    },
    {
      "source": "product-cna@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1"
    },
    {
      "source": "product-cna@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17"
    }
  ],
  "sourceIdentifier": "product-cna@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "product-cna@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

WID-SEC-W-2024-1634

Vulnerability from csaf_certbund - Published: 2024-07-16 22:00 - Updated: 2024-07-16 22:00

Summary

Microsoft GitHub Enterprise: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Angriff

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "GitHub ist ein netzbasierter Dienst zur Versionsverwaltung f\u00fcr Software-Entwicklungsprojekte.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Dateien zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1634 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1634.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1634 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1634"
      },
      {
        "category": "external",
        "summary": "Enterprise Server 3.13 release notes vom 2024-07-16",
        "url": "https://docs.github.com/de/enterprise-server@3.13/admin/release-notes"
      },
      {
        "category": "external",
        "summary": "Enterprise Server 3.12 release notes vom 2024-07-16",
        "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6"
      },
      {
        "category": "external",
        "summary": "Enterprise Server 3.11 release notes vom 2024-07-16",
        "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12"
      },
      {
        "category": "external",
        "summary": "Enterprise Server 3.10 release notes vom 2024-07-16",
        "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15-security-fixes"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft GitHub Enterprise: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-07-16T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:11:25.007+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1634",
      "initial_release_date": "2024-07-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.13.1",
                "product": {
                  "name": "Microsoft GitHub Enterprise \u003c3.13.1",
                  "product_id": "T036310"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.12.6",
                "product": {
                  "name": "Microsoft GitHub Enterprise \u003c3.12.6",
                  "product_id": "T036311"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.11.12",
                "product": {
                  "name": "Microsoft GitHub Enterprise \u003c3.11.12",
                  "product_id": "T036312"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.10.14",
                "product": {
                  "name": "Microsoft GitHub Enterprise \u003c3.10.14",
                  "product_id": "T036313"
                }
              }
            ],
            "category": "product_name",
            "name": "GitHub Enterprise"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-5566",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-5566"
    },
    {
      "cve": "CVE-2024-5795",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-5795"
    },
    {
      "cve": "CVE-2024-5815",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-5815"
    },
    {
      "cve": "CVE-2024-5816",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-5816"
    },
    {
      "cve": "CVE-2024-5817",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-5817"
    },
    {
      "cve": "CVE-2024-6336",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-6336"
    },
    {
      "cve": "CVE-2024-6395",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft GitHub Enterprise bestehen mehrere Schwachstellen. Diese Fehler sind auf mehrere sicherheitsrelevante Probleme zur\u00fcckzuf\u00fchren, darunter unkontrollierter Ressourcenverbrauch, unsachgem\u00e4\u00dfe Verwaltung von Berechtigungen und falsche Autorisierung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren. ."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2024-6395"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-6336 (GCVE-0-2024-6336)

GHSA-GCH4-6C9X-V2FR

FKIE_CVE-2024-6336

WID-SEC-W-2024-1634

Tags

Sightings

Nomenclature