GitHub Enterprise Server up to 3.3.16/3.4.11/3.5.8/3.6.4 authorization

Summaryinfo

A vulnerability was found in GitHub Enterprise Server up to 3.3.16/3.4.11/3.5.8/3.6.4. It has been classified as problematic. This impacts an unknown function. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2022-23741. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in GitHub Enterprise Server up to 3.3.16/3.4.11/3.5.8/3.6.4 (Bug Tracking Software). This affects an unknown code block. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.

The weakness was shared 12/15/2022. The advisory is shared at docs.github.com. This vulnerability is uniquely identified as CVE-2022-23741 since 01/19/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.3.17, 3.4.12, 3.5.9 or 3.6.5 eliminates this vulnerability. The upgrade is hosted for download at docs.github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-28677). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7
• 3.3.8
• 3.3.9
• 3.3.10
• 3.3.11
• 3.3.12
• 3.3.13
• 3.3.14
• 3.3.15
• 3.3.16
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion