CVE-2024-3684: High Admin Takeover in GitHub Enterprise Server

CVE-2024-3684 is a high severity flaw (CVSS 8.0) in GitHub Enterprise Server. A user with the editor role in the Management Console could gain admin access to the appliance through the Artifacts and Logs and Migrations Storage settings. It is fixed in 3.12.2, 3.11.8, 3.10.10 and 3.9.13. The sources describe the bug class differently.

Weakness class: CWE-88.

What's affected

• Product: GitHub Enterprise Server.
• Affected: all versions before 3.12, per the record.
• Fixed: 3.12.2, 3.11.8, 3.10.10 and 3.9.13.
• Access needed: access to the instance and the editor role in the Management Console.
• Severity: High, CVSS 8.0, and the 3.12.2 release notes say HIGH, so they agree.
• Source conflict on type: the record calls it a server side request forgery and lists CWE-88, argument injection. The release notes describe it as command injection through the storage settings, giving SSH access. Both say a low role gains administrative control.
• The KEV flag is false.

How to check if you're exposed

1. Read the version from the Management Console dashboard, or run ghe-version in the administrative shell.
2. Compare it with 3.9.13, 3.10.10, 3.11.8 or 3.12.2 for your series.
3. List editor role holders. The release notes say the role is deprecated.
4. Review the configured Artifacts and Logs and Migrations Storage settings for values you did not set.

What to do now

1. Upgrade to the fixed release in your series.
2. Cut the editor list to the minimum before the upgrade window.
3. Audit the storage settings and any credentials stored there, and rotate them if anything looks wrong.
4. Review administrative SSH sessions for unfamiliar activity.
5. Back up the appliance before the upgrade.

Why it matters

The record lists CWE-88, argument injection, in which user supplied settings are passed to a command in a way that lets them be read as extra options. The record's own description says SSRF, while the release notes say command injection. Rather than argue the label, focus on the shared outcome: configuration input is treated as more than data and a limited role reaches administrative control.

Like its sibling CVE-2024-3646, this one needs an editor account on the Management Console. That narrows the audience but does not remove it. Anyone with that role can reach a higher level of access than the role suggests.

Fix both in the same upgrade, and take the chance to review the role model on the appliance.

Quick check

Sources

• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes
• Gold entry for CVE-2024-3684

Last reviewed: 19 October 2026.