CVE-2024-1374

Summary

CVE-2024-1374: A command injection vulnerability was discovered in GitHub Enterprise Server, allowing an editor user in the Management Console to gain admin SSH access by manipulating nomad templates during audit log forwarding configuration. This vulnerability required access to the GitHub Enterprise Server instance and the Management Console with editor privileges. It affected all versions of GitHub Enterprise Server below 3.12, with patches released for versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. The issue was reported through the GitHub Bug Bounty program.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.