How severe is CVE-2024-0200?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2024-0200?

This is classified as CWE-470, which is a common weakness in software security.

CVE-2024-0200 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

Related Vulnerabilities

CVE-2018-1000613

CRITICAL

CVSS:9.8(Critical)

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsa...

CWE-4702018

CVE-2019-1003040

CRITICAL

CVSS:9.8(Critical)

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

CWE-4702019

CVE-2019-1003041

CRITICAL

CVSS:9.8(Critical)

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

CWE-4702019

CVE-2020-7857

CRITICAL

CVSS:9.8(Critical)

A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tob...

CWE-4702020

CVE-2021-31522

CRITICAL

CVSS:9.8(Critical)

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache ...

CWE-4702021

CVE-2022-41853

CRITICAL

CVSS:9.8(Critical)

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to c...

CWE-4702022