CVE-2024-5566

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal Access Token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
GitHub	GitHub Enterprise Server	>= 3.9.0, <= 3.9.16; >= 3.10.0, <= 3.10.13; >= 3.11.0, <= 3.11.11; >= 3.12.0, <= 3.12.5; >= 3.13, <= 3.13.0

References

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10Release Notes
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6Release Notes
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17Release Notes
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10Release Notes
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6Release Notes
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17Release Notes

Timeline

Published: Jul 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-556609.8SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Se CVE-2024-556618.8Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discov CVE-2024-556628.8XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where CVE-2024-556639.8XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.CVE-2024-55675.4The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5 CVE-2024-55696.2A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is trig CVE-2024-55706.5The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authe CVE-2024-55715.4The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl CVE-2024-55735.9The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-55747.5The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the CVE-2024-55754.7The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users CVE-2024-55765.4The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute wi