Analysis Summary

CVE-2024-10824 CVSS:6.5

GitHub Enterprise Server could allow a remote authenticated attacker to obtain sensitive information, caused by an authorization bypass vulnerability. By sending a specially crafted request, an attacker could exploit this vulnerability to access sensitive secret scanning alert data intended only for business owners.

CVE-2024-10007 CVSS:6.4

GitHub Enterprise Server could allow a local authenticated attacker to gain elevated privileges on the system, caused by a path collision and arbitrary code execution vulnerability. By sending a specially crafted request, an attacker could exploit this vulnerability to escalate privileges.

Impact

• Information Disclosure
• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2024-10824
• CVE-2024-10007

Affected Vendors

Remediation

Refer to GitHub Website for patch, upgrade or suggested workaround information.

CVE-2024-10824

CVE-2024-10007