CVE-2024-5795

A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17

Configurations

No configuration.

History

No history.

Information

Published : 2024-07-16 22:15

Updated : 2024-07-17 13:34

NVD link : CVE-2024-5795

Mitre link : CVE-2024-5795

CVE.ORG link : CVE-2024-5795

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2024-5795", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2024-07-16T22:15:05.253", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17", "source": "product-cna@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio en GitHub Enterprise Server que permiti\u00f3 a un atacante provocar un agotamiento ilimitado de los recursos enviando un gran payloads al servidor Git. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.14 y se solucion\u00f3 en las versiones 3.13.1, 3.12.6, 3.11.12, 3.10.14 y 3.9.17. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2024-07-17T13:34:20.520", "sourceIdentifier": "product-cna@github.com"}