CVE-2024-0507 is a medium severity (6.5) command injection in the Management Console of GitHub Enterprise Server. A user with the editor role could escalate privileges. GitHub fixed it in 3.11.3, 3.10.5, 3.9.8 and 3.8.13, so upgrade to the patch release for your series.
What's affected
- Product: GitHub Enterprise Server. The record says all versions were affected before the fixes.
- Fixed versions: 3.11.3, 3.10.5, 3.9.8 and 3.8.13.
- Precondition: an attacker needs a Management Console account with the editor role.
- Severity: NVD scores it 6.5 (Medium). The record shows CWE-20 and CWE-77.
- The record states the issue was reported through the GitHub Bug Bounty program.
How to check if you're exposed
- Sign in to the appliance admin shell and run ghe-version to read the installed release.
- Compare it with the fixed releases for your series: 3.8.13, 3.9.8, 3.10.5 or 3.11.3. A series older than 3.8 is not named in the record, so check the GitHub release notes for your series.
- List the accounts that hold the editor role in the Management Console and remove any that no longer need it.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Confirm your release with ghe-version.
- Upgrade to the fixed release for your series, or to a newer supported series.
- Review who holds Management Console editor access and trim it.
- Restrict network access to the Management Console to administrators.
- Scan your own repositories at gold.safeguard.sh/scan as part of normal hygiene.
Why it matters
The weaknesses are CWE-20, improper input validation, and CWE-77, command injection. Input handled by the Management Console reached a command in a way that changed what the command did. The result was privilege escalation for an account that already had a limited role.
This is an insider or stolen credential problem, not an anonymous internet one. The practical lesson is to keep administrative roles few, to keep the console off general networks and to patch appliance releases on a schedule. The record does not set a known exploited flag for this CVE.
Try it yourself
The demo below walks through the same workflow on sample data.
Click through it at your own pace, or open it full screen.
Quick check
Can an anonymous visitor use this?
No. The record says an attacker needs a Management Console user account with the editor role.
Sources
I fetched the 3.11 release notes page, but the fetch returned only the later part of the page, so the fixed versions here come from the NVD record text. Check the GitHub release notes for your series to confirm.
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.3
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.5
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.13
Last reviewed: 19 October 2026.
