Medium severity6.3NVD Advisory· Published Mar 21, 2024· Updated Jun 17, 2026
CVE-2024-1908
CVE-2024-1908
Description
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*range: <3.8.16
- (no CPE)range: <3.12, 3.8.16, 3.9.11, 3.10.8, 3.11.6
- (no CPE)range: 3.8.0
Patches
Vulnerability mechanics
References
4- docs.github.com/en/[email protected]/admin/release-notes/nvdRelease Notes
- docs.github.com/en/[email protected]/admin/release-notes/nvdRelease Notes
- https//docs.github.com/en/[email protected]/admin/release-notesnvdRelease Notes
- https//docs.github.com/en/[email protected]/admin/release-notesnvdRelease Notes
News mentions
0No linked articles in our index yet.