InfoSecBulletin Cybersecurity for mankind
GitHub has fixed three security flaws in its Enterprise Server product. One of these flaws was critical and allowed an attacker to gain administrative privileges. The most severe issue is called CVE-2024-6800. It has a CVSS score of 9.5.
“On GitHub Enterprise Server instances that use SAML single sign-on (SSO) authentication with specific IdPs utilizing publicly exposed signed federation metadata XML, an attacker could forge a SAML response to provision and/or gain access to a user account with site administrator privileges,” GitHub said in an advisory.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
The Microsoft-owned subsidiary has also addressed a pair of medium-severity flaws –
CVE-2024-7711 (CVSS score: 5.3) – A vulnerability that could allow an attacker to make unauthorized updates to an issue in a public repository.
CVE-2024-6337 (CVSS score: 5.9) – An authorization vulnerability was found on GitHub that allows an attacker to access the contents of private repositories. This vulnerability can be exploited by a GitHub App with “read” permission for contents and “write” permission for pull requests. The issue has been fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16 of GHES.
In May, GitHub fixed a serious security issue (CVE-2024-4985, CVSS score: 10.0) that could allow unauthorized access without needing authentication.
Organizations using a vulnerable self-hosted version of GHES should update to the latest version to protect against security threats.
