CyberzSOC

This vulnerability allows attackers to forge SAML responses, granting unauthorised administrative access A proof of concept is publicly available. CERT-EU strongly recommends updating as soon as The vulnerability CVE-2024-4985 , with a CVSS score of 10, involves SAML SSO with the optional encrypted assertions feature. An attacker could forge a SAML claim that contains correct user information. When GHES processes a fake SAML claim, it will not be able to validate its signature correctly, allowing an attacker to gain access to the GHES instance. The following GitHub Enterprise Server versions are affected: Only instances using SAML single sign-on (SSO) authentication are affected.