← Back

CVE-2024-2440

nvd nist
Published: Apr 19, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Exploitability: 0.7 / Impact: 5.2
Source: NVD

Description

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

Affected (4)

Github
1 product
Enterprise Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Github
Enterprise Server
Before 3.9.13
Enterprise Server
From 3.10.0 to 3.10.10
Enterprise Server
From 3.11.0 to 3.11.8
Enterprise Server
From 3.12.0 to 3.12.1

Related CWEs

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (8)

Source: product-cna@github.com
Release Notes
Source: product-cna@github.com
Release Notes
Source: product-cna@github.com
Release Notes
Source: product-cna@github.com
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes

Timeline

No history available yet.