CVE-2024-5746

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.6

EPSS

0.86%

Published

Jun 20, 2024

Modified

Aug 27, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L

Weaknesses (CWE)

CWE-918

Affected Products (4)

github · enterprise_server (up to 3.9.16)vulnerable

github · enterprise_server (up to 3.10.13)vulnerable

github · enterprise_server (up to 3.11.11)vulnerable

github · enterprise_server (up to 3.12.5)vulnerable

References (8)

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13

Release Notes