CVE-2024-2748

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affected GitHub Enterprise Server 3.12.0 and was fixed in versions 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-274809.8givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.CVE-2024-274889.8Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sen CVE-2024-274897.5An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.CVE-2024-27495.9The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its CVE-2024-274978.8Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.CVE-2024-274996.5Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.CVE-2024-27505.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button wid CVE-2024-275077.5libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.CVE-2024-275087.5Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.CVE-2024-27515.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_st CVE-2024-275157.2Osclass 5.1.2 is vulnerable to SQL Injection.CVE-2024-275169.8Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and ob