CVE-2024-2440

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.5

EPSS

0.45%

Published

Apr 19, 2024

Modified

Sep 2, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L

Weaknesses (CWE)

CWE-367

Affected Products (4)

github · enterprise_server (up to 3.9.13)vulnerable

github · enterprise_server (up to 3.10.10)vulnerable

github · enterprise_server (up to 3.11.8)vulnerable

github · enterprise_server (up to 3.12.1)vulnerable

References (8)

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10

Release Notes