GitHub_PCVELIST:CVE-2023-23760CVE-2023-23760 Path traversal in GitHub Enterprise Server leading to remote code execution
4.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
0.005 Low
EPSS
Percentile
75.6%
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program.
CNA Affected
[
{
"defaultStatus": "affected",
"product": "Enterprise Server",
"vendor": "GitHub",
"versions": [
{
"changes": [
{
"at": "3.4.17",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.4.16",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.5.14",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.5.13",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.6.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.6.9",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.7.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.7.6",
"status": "affected",
"version": "3.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.8.0"
}
]
}
]Related
4.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
0.005 Low
EPSS
Percentile
75.6%