What is CVE-2024-10824?

CVE-2024-10824 is a medium-severity vulnerability in Github Enterprise Server, classified under Missing Authorization. CVSS score: 6.5/10. Published 2024-11-07.

How severe is CVE-2024-10824?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Github Enterprise Server

CVE-2024-10824

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-owned repositories. This vulnerability affected GitHub Enterprise Server versions after 3.13.0 but prior to 3.14.0 and was fixed in version 3.13.2.

Vulnerability class: Broken Access Control

EPSS: 0.003 (26.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Github Enterprise Server — versions 3.13.0
Github Enterprise_server

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

product-cna@github.com (release-notes, Release Notes)

Frequently asked questions

What is CVE-2024-10824?: CVE-2024-10824 is a medium-severity vulnerability in Github Enterprise Server, classified under Missing Authorization. CVSS score: 6.5/10. Published 2024-11-07.
How severe is CVE-2024-10824?: Medium severity. CVSS v3 base score is 6.5 out of 10.