CVE-2024-1084

Summary

CVE-2024-1084 is a Cross-Site Scripting (XSS) vulnerability affecting the tag name pattern field in the tag protections UI of GitHub Enterprise Server. Malicious websites, requiring user interaction and social engineering, could exploit this flaw to make changes to user accounts by bypassing Content Security Policy (CSP) via created Cross-Site Request Forgery (CSRF) tokens. This vulnerability affected all versions of GitHub Enterprise Server before 3.12 and was resolved in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. It was reported via the GitHub Bug Bounty program.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.