VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Nov 7, 2024· Updated Jun 17, 2026

CVE-2024-8810

CVE-2024-8810

Description

A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17. This vulnerability was reported via the GitHub Bug Bounty program.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • GitHub/Enterprise Server4 versions
    cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*range: >=3.10.0,<3.10.17
    • cpe:2.3:a:github:enterprise_server:3.14.0:*:*:*:*:*:*:*
    • (no CPE)range: before 3.14, fixed in 3.14.1, 3.13.4, 3.12.9, 3.11.15, and 3.10.17
    • (no CPE)range: 3.10.0

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.