Skip to content
CVE Tracker
Back

CVE-2024-1908

Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation

Medium6.3EPSS 0.61%
Published
Updated
Reserved
Assigned by
GitHub_P

Description

An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSS scores of CVE-2024-1908, by who scored it
Scored byCVSSScoreVector
GitHub_PCNA (assigner)3.1Medium6.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVDNVD · Analyzed3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.61% · top 51% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

  • GitHub · Enterprise Server

    • affected 3.8.0 – < 3.8.16
    • affected 3.9.0 – < 3.9.11
    • affected 3.10.0 – < 3.10.8
    • affected 3.11.0 – < 3.11.6
    • unaffected 3.12.0

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .