Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-1082
CVE-2024-1082:
GitHub Enterprise Server vulnerability analysis and mitigation
Overview
A path traversal vulnerability (CVE-2024-1082) was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying arbitrary symbolic links to a GitHub Pages site with a specially crafted artifact tarball. The vulnerability was discovered and reported via the GitHub Bug Bounty program and affected all versions of GitHub Enterprise Server prior to 3.12 (NVD).
Technical details
The vulnerability is classified as a path traversal issue (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). It has a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and high confidentiality impact (NVD).
Impact
The vulnerability allows attackers to gain unauthorized read access to files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance (NVD).
Mitigation and workarounds
The vulnerability has been fixed in GitHub Enterprise Server versions 3.8.15, 3.9.10, 3.10.7, and 3.11.5. Users are advised to upgrade to these patched versions or later to mitigate the vulnerability (GitHub Release Notes).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management