Lucene search

K
cvelistGitHub_PCVELIST:CVE-2023-23761
HistoryApr 07, 2023 - 6:41 p.m.

CVE-2023-23761 Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists

2023-04-0718:41:47
CWE-287
GitHub_P
www.cve.org
github
authentication
vulnerability
secret gists
ssh
certificate authority
bug bounty

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

46.5%

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users’ secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist’s URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.9 and was fixed in versions 3.4.18, 3.5.15, 3.6.11, 3.7.8, and 3.8.1. This vulnerability was reported via the GitHub Bug Bounty program.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.4.18",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.4.17",
        "status": "affected",
        "version": "3.4.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.5.15",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.5.14",
        "status": "affected",
        "version": "3.5.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.6.11",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.6.10",
        "status": "affected",
        "version": "3.6.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.7.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.7.7",
        "status": "affected",
        "version": "3.7.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.8.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "3.8.1",
        "status": "affected",
        "version": "3.8.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "3.9.0"
      }
    ]
  }
]

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

46.5%

Related for CVELIST:CVE-2023-23761