Description

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

Classification

CVE ID: CVE-2024-2469

CVSS Base Severity: HIGH

CVSS Base Score: 8.0

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor: GitHub

Product: Enterprise Server

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.78% (probability of being exploited)

EPSS Percentile: 72.33% (scored less or equal to compared to others)

EPSS Date: 2025-04-20 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: total

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2024-2469
https://docs.github.com/en/[email protected]/admin/release-notes#3.8.17
https://docs.github.com/en/[email protected]/admin/release-notes#3.9.12
https://docs.github.com/en/[email protected]/admin/release-notes#3.10.9
https://docs.github.com/en/[email protected]/admin/release-notes#3.11.7
https://docs.github.com/en/[email protected]/admin/release-notes#3.12.1

Timeline