CVE-2024-5795

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5795
A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14 Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12 Release Notes
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6 Release Notes
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1 Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:3.13.0:*:*:*:*:*:*:*
History

17 Sep 2024, 16:24

Type Values Removed Values Added
First Time Github
Github enterprise Server
CPE cpe:2.3:a:github:enterprise_server:3.13.0:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.7 		v2 : unknown
v3 : 6.5
Summary
  • (es) Se identificó una vulnerabilidad de denegación de servicio en GitHub Enterprise Server que permitió a un atacante provocar un agotamiento ilimitado de los recursos enviando un gran payloads al servidor Git. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.14 y se solucionó en las versiones 3.13.1, 3.12.6, 3.11.12, 3.10.14 y 3.9.17. Esta vulnerabilidad se informó a través del programa GitHub Bug Bounty.
References () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14 - () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12 - () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6 - () https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1 - () https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17 - () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17 - Release Notes

16 Jul 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 22:15

Updated : 2024-09-17 16:24

NVD link : CVE-2024-5795

Mitre link : CVE-2024-5795

CVE.ORG link : CVE-2024-5795

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-400

Uncontrolled Resource Consumption