CVE-2024-10824

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-owned repositories. This vulnerability affected GitHub Enterprise Server versions after 3.13.0 but prior to 3.14.0 and was fixed in version 3.13.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.2	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*

History

27 Aug 2025, 16:27

Type	Values Removed	Values Added
CPE		cpe:2.3:a:github:enterprise_server::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
First Time		Github Github enterprise Server
References	~~() https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.2 -~~	() https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.2 - Release Notes

Information

Published : 2024-11-07 22:15

Updated : 2025-08-27 16:27

NVD link : CVE-2024-10824

Mitre link : CVE-2024-10824

CVE.ORG link : CVE-2024-10824

JSON object : View

Products Affected

github

enterprise_server

CWE

CWE-862

Missing Authorization

{"id": "CVE-2024-10824", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 6.0, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-11-07T22:15:20.450", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.2", "tags": ["Release Notes"], "source": "product-cna@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-owned repositories. This vulnerability affected GitHub Enterprise Server versions after 3.13.0 but prior to 3.14.0 and was fixed in version 3.13.2."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en GitHub Enterprise Server que permit\u00eda a usuarios internos no autorizados acceder a datos confidenciales de alertas de escaneo de secretos destinados \u00fanicamente a propietarios de empresas. Este problema solo lo pod\u00edan aprovechar los miembros de la organizaci\u00f3n con un token de acceso personal (PAT) y requer\u00eda que el escaneo de secretos estuviera habilitado en los repositorios propiedad del usuario. Esta vulnerabilidad afect\u00f3 a las versiones de GitHub Enterprise Server posteriores a la 3.13.0 pero anteriores a la 3.14.0 y se solucion\u00f3 en la versi\u00f3n 3.13.2."}], "lastModified": "2025-08-27T16:27:58.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E306AF83-8B8B-45B7-ADB6-5443126585D1", "versionEndExcluding": "3.13.2", "versionStartIncluding": "3.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}