Fixed two moderately rated bugs

One of the other vulnerabilities fixed with the patch is CVE-2024-7711, which received a “medium” severity rating at a 5.3 CVSS score. The vulnerability is an incorrect authorization vulnerability allowing an attacker to update the title, assignees, and labels of any issue inside a public repository, according to GitHub.

CVE-2024-6337, the third vulnerability addressed in the releases, is another incorrect authorization vulnerability that can allow an attacker to disclose the issue contents from a private repository using a GitHub App with only contents: read and pull requests: write permissions.

“This (CVE-2024-6337) was only exploitable via user access token, and installation access tokens were not impacted,” GitHub added. The vulnerability received a CVSS rating of 5.9. This is the second time in three months that GitHub has been hit with a critical SAML authentication request forgery bug. In May, the GitHub Enterprise Server was affected by a critical 10-out-of-10 CVSS scorer that exposed GitHub enterprise customers to attackers getting admin privileges to business accounts.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Newly patched Ivanti CSA flaw under active exploitation

In January, after a series of attacks that exploited zero-day vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure, CISA took the unusual step of ordering all federal agencies to

Read More

New MOVEit transfer vulnerabilities that require patching (2024)

EXECUTIVE SUMMARY: Remember last year’s MOVEit meltdown? Get ready for a reprise… For anyone who missed last year’s madness, MOVEit Transfer is a popular managed file transfer product sold by

Read More

Critical Ivanti flaw exploited despite available patches

CISA has added the vulnerability to its Known Exploited Vulnerability (KEV) Catalogue. EPM raked with RCE flaws The 2022 and prior releases of Ivanti’s EPM, available to customers under the

Read More