Vulnerability Description
A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. A mitigating factor is that the attacker would have to be a trusted GitHub Enterprise Server user, and the victim would have to visit a tag in the attacker's fork of their own repository. vulnerability affected all versions of GitHub Enterprise Server prior 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Github | Enterprise Server | >= 3.9.0, < 3.9.17 |
Related Weaknesses (CWE)
References
- https://docs.github.com/en/[email protected]/admin/release-notes#3.9.17Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.10.14Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.11.12Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.12.6Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.13.1Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.9.17Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.10.14Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.11.12Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.12.6Release Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.13.1Release Notes
FAQ
What is CVE-2024-5815?
CVE-2024-5815 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. A mitigating factor is that the atta...
How severe is CVE-2024-5815?
CVE-2024-5815 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-5815?
Check the references section above for vendor advisories and patch information. Affected products include: Github Enterprise Server.