GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access – OfficialSarkar

ByOfficial Sarkar

Oct 16, 2024Ravie LakshmananEnterprise Security / Vulnerability

Enterprise Server

GitHub has released security updates for Enterprise Server (GHES) to address multiple issues, including a critical bug that could allow unauthorized access to an instance.

The vulnerability, tracked as CVE-2024-9487, carries a CVS score of 9.5 out of a maximum of 10.0

“An attacker could bypass SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, allowing unauthorized provisioning of users and access to the instance, by exploiting an improper verification of cryptographic signatures vulnerability in GitHub Enterprise Server,” GitHub said in an alert.

The Microsoft-owned company characterized the flaw as a regression that was introduced as part of follow-up remediation from CVE-2024-4985 (CVSS score: 10.0), a maximum severity vulnerability that was patched back in May 2024.

Cybersecurity

Also fixed by GitHub are two other shortcomings –

  • CVE-2024-9539 (CVSS score: 5.7) – An information disclosure vulnerability that could enable an attacker to retrieve metadata belonging to a victim user upon clicking malicious URLs for SVG assets
  • A sensitive data exposure in HTML forms in the management console (no CVE)

All three security vulnerabilities have been addressed in Enterprise Server versions 3.14.2, 3.13.5, 3.12.10, and 3.11.16.

Back in August, GitHub also patched a critical security defect (CVE-2024-6800, CVSS score: 9.5) that could be abused to gain site administrator privileges.

Organizations that are running a vulnerable self-hosted version of GHES are highly advised to update to the latest version to safeguard against potential security threats.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Source: TheHackerNews

Similar Posts

N. Korean Hackers Deploy New KLogEXE and FPSpy Malware in Targeted Attacks – OfficialSarkar

N. Korean Hackers Deploy New KLogEXE and FPSpy Malware in Targeted Attacks – OfficialSarkar

ByOfficial Sarkar

Sep 26, 2024Ravie LakshmananCyber Attack / Malware Threat actors with ties to North Korea have been observed leveraging two new malware strains dubbed KLogEXE and FPSpy. The activity has been attributed to an adversary tracked as Kimsuky, which is also known as APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (formerly Thallium), Sparkling Pisces, Springtail, and Velvet…

Necro Android Malware Found in Popular Camera and Browser Apps on Play Store – OfficialSarkar

Necro Android Malware Found in Popular Camera and Browser Apps on Play Store – OfficialSarkar

ByOfficial Sarkar

Sep 24, 2024Ravie LakshmananMobile Security / Malware Altered versions of legitimate Android apps associated with Spotify, WhatsApp, and Minecraft have been used to deliver a new version of a known malware loader called Necro. Kaspersky said some of the malicious apps have also been found on the Google Play Store. They have been cumulatively downloaded…

CISA Warns of Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance – OfficialSarkar

CISA Warns of Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance – OfficialSarkar

ByOfficial Sarkar

Oct 11, 2024Ravie LakshmananVulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that it has observed threat actors leveraging unencrypted persistent cookies managed by the F5 BIG-IP Local Traffic Manager (LTM) module to conduct reconnaissance of target networks. It said the module is being used to enumerate other non-internet-facing devices…

New Android Trojan “BlankBot” Targets Turkish Users’ Financial Data – OfficialSarkar

New Android Trojan “BlankBot” Targets Turkish Users’ Financial Data – OfficialSarkar

ByOfficial Sarkar

Aug 05, 2024Ravie LakshmananMobile Security / Financial Security Cybersecurity researchers have discovered a new Android banking trojan called BlankBot targeting Turkish users with an aim to steal financial information. “BlankBot features a range of malicious capabilities, which include customer injections, keylogging, screen recording and it communicates with a control server over a WebSocket connection,” Intel…

CISA Adds Twilio Authy and IE Flaws to Exploited Vulnerabilities List – OfficialSarkar

CISA Adds Twilio Authy and IE Flaws to Exploited Vulnerabilities List – OfficialSarkar

ByOfficial Sarkar

Jul 24, 2024NewsroomVulnerability / Software Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below – CVE-2012-4792 (CVSS score: 9.3) – Microsoft Internet Explorer Use-After-Free Vulnerability CVE-2024-39891 (CVSS score: 5.3) – Twilio Authy…

Leave a Reply

Your email address will not be published. Required fields are marked *