CVE-2022-23741
14.12.2022, 19:15
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| github | enterprise_server | 𝑥 < 3.3.17 |
| github | enterprise_server | 3.4.0 ≤ 𝑥 < 3.4.12 |
| github | enterprise_server | 3.5.0 ≤ 𝑥 < 3.5.9 |
| github | enterprise_server | 3.6.0 ≤ 𝑥 < 3.6.5 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| github | github | 3.3 ≤ 𝑥 < 3.3.17 | CNA |
| github | github | 3.4 ≤ 𝑥 < 3.4.12 | CNA |
| github | github | 3.5 ≤ 𝑥 < 3.5.9 | CNA |
| github | github | 3.6 ≤ 𝑥 < 3.6.5 | CNA |
References