GitHub Enterprise Server up to 3.11.0 authorization

Summaryinfo

A vulnerability has been found in GitHub Enterprise Server up to 3.7.18/3.8.11/3.9.6/3.10.3/3.11.0 and classified as problematic. The impacted element is an unknown function. The manipulation leads to authorization. This vulnerability is listed as CVE-2023-51379. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in GitHub Enterprise Server up to 3.7.18/3.8.11/3.9.6/3.10.3/3.11.0 (Bug Tracking Software) and classified as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is integrity. The summary by CVE is:

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 

The weakness was presented 12/22/2023 by Douglas Day. It is possible to read the advisory at docs.github.com. The identification of this vulnerability is CVE-2023-51379 since 12/18/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.7, 3.8.12, 3.9.7, 3.10.4, 3.11.1 or 3.17.19 eliminates this vulnerability. The upgrade is hosted for download at docs.github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.7.9
• 3.7.10
• 3.7.11
• 3.7.12
• 3.7.13
• 3.7.14
• 3.7.15
• 3.7.16
• 3.7.17
• 3.7.18
• 3.8
• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6
• 3.8.7
• 3.8.8
• 3.8.9
• 3.8.10
• 3.8.11
• 3.9
• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.10
• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.11.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion