Lucene search

K
hackeroneInspector-ambitiousH1:2185545
HistorySep 28, 2023 - 10:30 a.m.

GitHub: Persistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to Organization

2023-09-2810:30:14
inspector-ambitious
hackerone.com
$4000
2
github
enterprise server
race condition
unauthorized access
user conversion
vulnerability
bug bounty
patch

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

Related for H1:2185545