CVE-2024-8770

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitHub	GitHub Enterprise Server	>= 3.14, <= 3.14.0; >= 3.13.0, <= 3.13.3; >= 3.12.0, <= 3.12.8; >= 3.11.0, <= 3.11.14; >= 3.10.0, <= 3.10.16

References

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.17Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.15Release Notes
https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.9Release Notes
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.4Release Notes
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.1Release Notes

Timeline

Published: Sep 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-87714.3The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-87724.351l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition CVE-2024-87738.3SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vul CVE-2024-87747.7The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges t CVE-2024-87755.5A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a CVE-2024-87766.1SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript CVE-2024-87777.5OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system confi CVE-2024-87786.5OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular pri CVE-2024-87798.8OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers CVE-2024-87806.5OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regu CVE-2024-87818.7Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allo CVE-2024-87829.8A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/t