CVE-2024-9487

Summary

CVE-2024-9487 is an improper verification of cryptographic signatures vulnerability in GitHub Enterprise Server. This issue allowed an attacker to bypass Single Sign-On (SSO) authentication through SAML, resulting in unauthorized user provisioning and access to the instance. The exploitation of this vulnerability required the encrypted assertions feature to be enabled, and the attacker needed direct network access, as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. The vulnerability was reported through the GitHub Bug Bounty program.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.