Back to overview

CVE-2024-4985

CRITICAL Exploitation: PoC
10.0
CVSS 4.0
Description
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program.

Metadata

CVE ID
CVE-2024-4985
State
PUBLISHED
Assigner
GitHub_P
Reserved
2024-05-16 03:36 UTC
Published
2024-05-20 21:17 UTC
Last updated
2024-08-01 20:55 UTC
Primary CWE
CWE-303
CWE-303: Incorrect Implementation of Authentication Algorith…
Vendor / Product
GitHub / Enterprise Server
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/R:U/V:C/RE:M/U:Red
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
GitHub Enterprise Server — 3.9.0 ≤ 3.9.14, 3.10.0 ≤ 3.10.11, 3.11.0 ≤ 3.11.9, 3.12.0 ≤ 3.12.3 …
Weakness (CWE)
CWESourceDescription
CWE-303 cna CWE-303: Incorrect Implementation of Authentication Algorithm
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/R:U/V:C/RE:M/U:Red
References (4)
Back to overview