CVE-2024-8770
Last modified
CVE-2024-8770 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Github | Enterprise Server | >= 3.10.0, < 3.10.17 |
| Github | Enterprise Server | >= 3.11.0, < 3.11.15 |
| Github | Enterprise Server | >= 3.12.0, < 3.12.9 |
| Github | Enterprise Server | >= 3.13.0, < 3.13.4 |
| Github | Enterprise Server | 3.14.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-8770?
How severe is CVE-2024-8770?
How do I fix CVE-2024-8770?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-8764A vulnerability in lunary-ai/lunary, as of commit be54057, a…7.5
- CVE-2024-8765In lunary-ai/lunary, the privilege check mechanism is flawed…7.3
- CVE-2024-8766Local privilege escalation due to DLL hijacking vulnerabilit…6.7
- CVE-2024-8767Sensitive data disclosure and manipulation due to unnecessar…9.9
- CVE-2024-8768A flaw was found in the vLLM library. A completions API requ…7.5
- CVE-2024-8769A vulnerability in the `LockManager.release_locks` function …9.1
- CVE-2024-8771The Email Subscribers by Icegram Express – Email Marketing, …4.3
- CVE-2024-877251l3nc3, member of the AXIS OS Bug Bounty Program, has found…4.3
- CVE-2024-8773SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade…8.3
- CVE-2024-8774The SIMPLE.ERP client stores superuser password in a recover…7.7
- CVE-2024-8775A flaw was found in Ansible, where sensitive information sto…5.5
- CVE-2024-8776SmartRobot from INTUMIT does not properly validate a specifi…6.1
Are you affected by CVE-2024-8770?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST