DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Microsoft GitHub Enterprise: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-07-16
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren.
01
beschreibt (7)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-6395US | medium5.3 | — | ||
An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This… | ||||
| CVE-2024-6336US | medium5.3 | — | ||
A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organ… | ||||
| CVE-2024-5817US | medium6.5OT erhöht | — | ||
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was only exploitable in inte… | ||||
| CVE-2024-5816US | medium5.3OT erhöht | — | ||
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via a scoped user access… | ||||
| CVE-2024-5815US | medium6.5 | — | ||
A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. A mitigating fac… | ||||
| CVE-2024-5795US | medium6.5 | — | ||
A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git s… | ||||
| CVE-2024-5566US | medium6.5 | — | ||
An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal Access Token. This vu… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Enterprise Server 3.13 release notes vom 2024-07-16external
- Enterprise Server 3.10 release notes vom 2024-07-16external
- Enterprise Server 3.11 release notes vom 2024-07-16external
- Enterprise Server 3.12 release notes vom 2024-07-16external
- WID-SEC-W-2024-1634 - CSAF Versionself
- WID-SEC-2024-1634 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan