Vulnerability in Github Enterprise Server
CVE-2024-9487
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Ex…
EPSS: 0.507 (97.9th percentile) — read the EPSS interpretation.
Affected products
- Github Enterprise Server — versions 3.11.0, 3.12.0, 3.13.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- docs.github.com/en/enterprise-server@3.11/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.12/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.13/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.14/admin/release-notes (release-notes)
Frequently asked questions
- What is CVE-2024-9487?
- CVE-2024-9487 is a vulnerability in Github Enterprise Server, classified under Improper Verification of Cryptographic Signature. Published 2024-10-10.
- Is CVE-2024-9487 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.