CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

EPSS

71.73% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-470

Published

2024-01-16

Updated

2024-08-01

Proof-of-concept exploits (1)

• convisolabs/CVE-2024-0507_CVE-2024-0200-github1★ · 2024-09-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0200.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-22204
• CVE-2022-24834
• CVE-2024-0507
• CVE-2024-43044
• CVE-2024-0199
• CVE-2024-0204