Lucene search

K
cvelistGitHub_PCVELIST:CVE-2023-46649
HistoryDec 21, 2023 - 8:45 p.m.

CVE-2023-46649 Race Condition allows Administrative Access on Organization Repositories

2023-12-2120:45:43
CWE-367
GitHub_P
www.cve.org
github
enterprise server
cve-2023-46649
attacker access
race condition
vulnerability
fixed version

6.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user.Β This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.7.19",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.7.18",
        "status": "affected",
        "version": "3.7.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.8.12",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.8.11",
        "status": "affected",
        "version": "3.8.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.9.7",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.9.6",
        "status": "affected",
        "version": "3.9.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.10.4",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.10.3",
        "status": "affected",
        "version": "3.10.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.11.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.11.0",
        "status": "affected",
        "version": "3.11",
        "versionType": "semver"
      }
    ]
  }
]

6.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

Related for CVELIST:CVE-2023-46649