GitHub Enterprise Server up to 3.11.0 authorization

Summaryinfo

A vulnerability was found in GitHub Enterprise Server up to 3.7.18/3.8.11/3.9.6/3.10.3/3.11.0 and classified as problematic. This affects an unknown function. The manipulation results in authorization. This vulnerability is cataloged as CVE-2023-51380. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in GitHub Enterprise Server up to 3.7.18/3.8.11/3.9.6/3.10.3/3.11.0 (Bug Tracking Software). It has been classified as problematic. Affected is an unknown code. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality. CVE summarizes:

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 

The weakness was shared 12/22/2023 by Douglas Day. The advisory is shared for download at docs.github.com. This vulnerability is traded as CVE-2023-51380 since 12/18/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.7, 3.8.12, 3.9.7, 3.10.4, 3.11.1 or 3.17.19 eliminates this vulnerability. The upgrade is hosted for download at docs.github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.7.9
• 3.7.10
• 3.7.11
• 3.7.12
• 3.7.13
• 3.7.14
• 3.7.15
• 3.7.16
• 3.7.17
• 3.7.18
• 3.8
• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6
• 3.8.7
• 3.8.8
• 3.8.9
• 3.8.10
• 3.8.11
• 3.9
• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.10
• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.11.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion