CVE-2024-0200
Published: 16 January 2024
Summary
CVE-2024-0200 is a high-severity Unsafe Reflection (CWE-470) vulnerability in Github Enterprise Server. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An unsafe reflection vulnerability identified as CWE-470 was present in GitHub Enterprise Server, allowing reflection injection that could result in execution of attacker-controlled methods and remote code execution. The flaw affected every version of the product prior to 3.12 and carried a CVSS 3.1 score of 7.2.
Exploitation requires an authenticated actor holding the organization owner role on the GitHub Enterprise Server instance; with that access the attacker can invoke arbitrary methods leading to code execution on the server. No unauthenticated or lower-privileged vectors are described.
Official release notes for versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3 state that the issue has been corrected in those builds, and administrators are advised to upgrade any earlier installations. The EPSS score reached a peak of 0.7450 with a current value of 0.6951, indicating sustained but not sharply rising exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-15999
Vulnerability details
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be…
more
logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Externally controlled class or code selection can be resolved and invoked inside the chamber, surfacing unsafe reflection without system impact.