GitHub Server (v <3.14) Private Repo Enumeration via Deploy Keys
CVE-2024-6395 Published on July 16, 2024
GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys
An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2024-6395 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2024-6395
Want to know whenever a new CVE is published for github Enterprise Server? stack.watch will email you.
Affected Versions
GitHub Enterprise Server:- Version 3.10.0, <= 3.10.13 is affected.
- Version 3.11.0, <= 3.11.11 is affected.
- Version 3.12.0, <= 3.12.5 is affected.
- Version 3.13, <= 3.13.0 is affected.
- Version 3.9.0, <= 3.9.16 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.