vulnerability
GitHub Enterprise Hardcoded Secret
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Mar 15, 2017 | Feb 3, 2021 | Feb 18, 2025 |
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Mar 15, 2017
Added
Feb 3, 2021
Modified
Feb 18, 2025
Description
Github Enterprise versions 2.8.0 - 2.8.6 contains a vulnerability in the session management where a hard-coded secret was used. This could be abused to sign serialised objects and combined with another vulnerability in unsafe deserialisation it could lead to remote code execution.
This check requires the Metasploit Remote Check Service to be enabled on Scan Engines. Please see the Metasploit Remote Check Service documentation for instructions on how to enable this functionality.
Solution
github-enterprise-update-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.