CVE-2024-1908: 
GitHub Enterprise Server vulnerability analysis and mitigation

An Improper Privilege Management vulnerability (CVE-2024-1908) was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. The vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability required an attacker to have an account on the server instance with non-default settings for GitHub Connect (NVD).

The vulnerability is classified as an Improper Privilege Management issue (CWE-269) with a CVSS v3.1 base score of 6.3 (MEDIUM). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is changed (S:C) with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

The vulnerability allowed attackers to access private repository data using the Enterprise Actions GitHub Connect download token. This represents a significant confidentiality breach for organizations using GitHub Enterprise Server with GitHub Connect enabled (GitHub Release Notes).

Exploitation requires an attacker to have an account on the GitHub Enterprise Server instance and non-default settings for GitHub Connect. The vulnerability was discovered and reported through the GitHub Bug Bounty program (NVD).

The vulnerability has been fixed in GitHub Enterprise Server versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. Organizations should upgrade to these or later versions to mitigate the risk. As part of the fix, the Actions download token has been modified to be a permissionless token (GitHub Release Notes).