CVE-2024-2440 MEDIUM

CVE-2024-2440: Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions

Vendor Github
Product Enterprise Server
Weakness CWE-367
Published April 19, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

Key dates

02Disclosure timeline

April 19, 2024 CVE published
August 1, 2024 Record updated