Vulnerabilitycritical
GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-4985 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional… | 10.0 | 3% | ||
| CVE-2024-6800 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers… | 9.5 | 2% | ||
| CVE-2024-9487 | Improper SAML Signature Verification Bypasses SSO in GitHub Enterprise Server | 9.5 | 26% | ||
| CVE-2024-9539 | An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata… | 5.7 | <1% |
From the original article
1 min read at thehackernews.com
Ravie Lakshmanan Oct 16, 2024 Enterprise Security / Vulnerability GitHub has released security updates for Enterprise Server (GHES) to address multiple issues, including a critical bug that could allow unauthorized access to an instance. The vulnerability, tracked as CVE-2024-9487, carries a CVS score of 9. 5 out of a maximum of 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.