CVE-2024-5746

{"id": "CVE-2024-5746", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "published": "2024-06-20T22:15:16.100", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role.\u00a0This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de Server-Side Request Forgery en GitHub Enterprise Server que permiti\u00f3 a un atacante con la funci\u00f3n de administrador del sitio obtener capacidad de ejecuci\u00f3n de c\u00f3digo arbitrario en la instancia de GitHub Enterprise Server. La explotaci\u00f3n requer\u00eda acceso autenticado a GitHub Enterprise Server como usuario con la funci\u00f3n de Administrador del sitio. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.13 y se solucion\u00f3 en las versiones 3.12.5, 3.11.11, 3.10.13 y 3.9.16. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2024-11-21T09:48:16.580", "sourceIdentifier": "product-cna@github.com"}