CVE-2024-3646

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.12.2, 3.11.8, 3.10.10, and 3.9.13. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-20

• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10Release Notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8Release Notes
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2Release Notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13Release Notes
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10Release Notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8Release Notes
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2Release Notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13Release Notes

Published

Apr 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36454Use of uninitialized resource issue exists in IPCOM EX2 Seri…5.3
• CVE-2024-36455An improper input validation allows an unauthenticated attac…9.4
• CVE-2024-36456This vulnerability allows an unauthenticated attacker to ach…9.4
• CVE-2024-36457The vulnerability allows an attacker to bypass the authentic…5.3
• CVE-2024-36458The vulnerability allows a malicious low-privileged PAM user…5.1
• CVE-2024-36459A CRLF cross-site scripting vulnerability has been identifie…8.4
• CVE-2024-36460The front-end audit log allows viewing of unprotected plaint…8.1
• CVE-2024-36461Within Zabbix, users have the ability to directly modify mem…8.8
• CVE-2024-36462Uncontrolled resource consumption refers to a software vulne…7.5
• CVE-2024-36463The implementation of atob in "Zabbix JS" allows to create a…8.8
• CVE-2024-36464When exporting media types, the password is exported in the …2.7
• CVE-2024-36465A low privilege (regular) Zabbix user with API access can us…8.8