How severe is CVE-2024-0200?

CVE-2024-0200 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability low.

Is CVE-2024-0200 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 72% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-0200?

CVE-2024-0200 affects Github Enterprise Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-0200?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-0200 have an EU (EUVD) identifier?

Yes. CVE-2024-0200 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-15999.

When was CVE-2024-0200 published?

CVE-2024-0200 was published on 2024-01-16 and last updated on 2026-06-17.

CVE-2024-0200

CVE-2024-0200 is a high-severity vulnerability in Github Enterprise Server with a CVSS 3.x base score of 7.2. Its EPSS exploit-prediction score of 72% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-470.

Key facts

Severity: High (CVSS 3.x base score 7.2)
EPSS exploit prediction: 72% (99th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-15999
Weakness: CWE-470
Affected product: Github Enterprise Server
Published: 2024-01-16
Last modified: 2026-06-17

Description

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

Frequently asked questions

What is CVE-2024-0200?: An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.
How severe is CVE-2024-0200?: CVE-2024-0200 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability low.
Is CVE-2024-0200 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 72% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-0200?: CVE-2024-0200 affects Github Enterprise Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-0200?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-0200 have an EU (EUVD) identifier?: Yes. CVE-2024-0200 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-15999.
When was CVE-2024-0200 published?: CVE-2024-0200 was published on 2024-01-16 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*

More vulnerabilities in Github Enterprise Server

CVE-2026-8034 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that…
CVE-2024-6800 — Critical (CVSS 9.8): An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication…
CVE-2024-4985 — Critical (CVSS 9.8): An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single…
CVE-2022-23739 — Critical (CVSS 9.8): An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of…
CVE-2022-46255 — Critical (CVSS 9.8): An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server…
CVE-2021-22869 — Critical (CVSS 9.8): An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted…

All CVEs affecting Github Enterprise Server →

Other CWE-470 (Unsafe Reflection) vulnerabilities

CVE-2026-42027 — Critical (CVSS 9.8): Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before…
CVE-2025-34393 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify…
CVE-2025-53693 — Critical (CVSS 9.8): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore…
CVE-2023-6943 — Critical (CVSS 9.8): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric…
CVE-2021-31522 — Critical (CVSS 9.8): Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version…
CVE-2019-1003041 — Critical (CVSS 9.8): A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary…

Browse all CWE-470 (Unsafe Reflection) vulnerabilities →