CVE-2024-5746

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-918

• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13Release Notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11Release Notes
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5Release Notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16Release Notes
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13Release Notes
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11Release Notes
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5Release Notes
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16Release Notes

Published

Jun 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-57440D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buff…7.5
• CVE-2024-5745A vulnerability was found in itsourcecode Bakery Online Orde…9.8
• CVE-2024-57450ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Cre…9.8
• CVE-2024-57451ChestnutCMS <=1.5.0 has a directory traversal vulnerability …7.5
• CVE-2024-57452ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerabi…7.5
• CVE-2024-57459A time-based SQL injection vulnerability exists in mydetails…7.3
• CVE-2024-5747Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-57471H3C N12 V100R005 contains a buffer overflow vulnerability du…9.8
• CVE-2024-57473H3C N12 V100R005 contains a buffer overflow vulnerability du…9.8
• CVE-2024-57479H3C N12 V100R005 contains a buffer overflow vulnerability du…9.8
• CVE-2024-57480H3C N12 V100R005 contains a buffer overflow vulnerability du…9.8
• CVE-2024-57482H3C N12 V100R005 contains a buffer overflow vulnerability du…9.8