CVE-2024-6800

CRITICAL EPSS 71.5%
Published Aug 20, 20241y ago · Modified Jun 17, 20262w ago
9.5 CVSS 4.0
Critical
Find Similar
Published Aug 20, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Details

Base Score
9.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:H/U:Red
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
71.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-347

Affected Products 4

VendorProductVersionRange
githubenterprise_server*≥3.10.0  –  <3.10.16
githubenterprise_server*≥3.11.0  –  <3.11.14
githubenterprise_server*≥3.12.0  –  <3.12.8
githubenterprise_server*≥3.13.0  –  <3.13.3

References 4

  • docs.github.com https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16
    Release NotesVendor Advisory
  • docs.github.com https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14
    Release NotesVendor Advisory
  • docs.github.com https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8
    Release NotesVendor Advisory
  • docs.github.com https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3
    Release NotesVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.