CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-470
• CWE-470

• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.5Release Notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.3Release Notes
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.13Release Notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.8Release Notes
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.5Release Notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.3Release Notes
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.13Release Notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.8Release Notes

Published

Jan 16, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0194A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-0195A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-0196A vulnerability has been found in Magic-Api up to 2.0.1 and …8.8
• CVE-2024-0197A flaw in the installer for Thales SafeNet Sentinel HASP LDK…7.8
• CVE-2024-0198Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-0199An authorization bypass vulnerability was discovered in GitL…8
• CVE-2024-0201The Product Expiry for WooCommerce plugin for WordPress is v…4.3
• CVE-2024-0202A security vulnerability has been identified in the cryptlib…5.9
• CVE-2024-0203The Digits plugin for WordPress is vulnerable to Cross-Site …8.8
• CVE-2024-0204Authentication bypass in Fortra's GoAnywhere MFT prior to 7.…9.8
• CVE-2024-0206 A symbolic link manipulation vulnerability in Trellix Anti-…7.8
• CVE-2024-0207HTTP3 dissector crash in Wireshark 4.2.0 allows denial of se…7.5