CVE-2024-2443 is a command injection in GitHub Enterprise Server. NVD scores it 9.1 critical, while GitHub's release notes label it high. An editor in the Management Console could gain admin SSH access. Fixed in 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1.
What's affected
All versions of GitHub Enterprise Server prior to 3.13, according to the record. Fixes were released in:
- 3.8.17
- 3.9.12
- 3.10.9
- 3.11.7
- 3.12.1
Version 3.13 was not affected. GitHub reported the issue came through its Bug Bounty program.
The two sources differ on severity. The NVD record scores it 9.1 (critical). The GitHub Enterprise Server 3.12.1 release notes list it under security fixes with a HIGH label. Treat it as serious in both readings, but note that exploitation needs an account.
How to check if you're exposed
Find your appliance version in the Management Console or in the footer of the site admin pages, and compare it with the list above. Anything below the fixed release for its series, and anything older than 3.13 without a listed fix, should be treated as affected.
Next, list who holds the editor role in the Management Console. The record says exploitation needed that access plus access to the instance, so the real exposure depends on how widely that role is granted.
What to do now
- Upgrade each appliance to the fixed release for its series, or to 3.13 or later.
- Review Management Console users and remove the editor role from anyone who does not need it.
- Restrict network access to the Management Console to a small admin network.
- Check audit logs for unexpected configuration changes, particularly to GeoJSON settings.
- Plan to leave old series. GitHub's documentation notes that 3.12 has been discontinued, so a supported release is the lasting answer.
Why it matters
The record classifies the weakness as CWE-20, improper input validation. A setting entered in the Management Console reached a command on the appliance without being checked, so a user with a limited role gained SSH access as an administrator.
The attack needs a foothold first, which is why GitHub rates it below the NVD figure. Still, source code platforms are high value targets, and an appliance admin shell exposes everything on it.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and neither the record nor the release notes I read say it was exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Who can exploit this?
Per the record, someone with the editor role in the Management Console, who has access to the instance.
Is a workaround listed?
None appears in the record or the release notes excerpt I read. Upgrade, and tighten who holds the editor role.
Sources
- GitHub Enterprise Server 3.12 release notes
- NVD record for CVE-2024-2443
Last reviewed: 19 October 2026.
