PT-2023-19191 · Github · Github Enterprise Server

Inspector-Amibitious

·

Publicado

2023-09-22

·

Atualizado

2023-09-25

·

CVE-2023-23766

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.6.17 GitHub Enterprise Server versions prior to 3.7.15 GitHub Enterprise Server versions prior to 3.8.8 GitHub Enterprise Server versions prior to 3.9.3 GitHub Enterprise Server versions prior to 3.10.1
Description An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To exploit this issue, an attacker would need write access to the repository. This vulnerability was reported via the GitHub Bug Bounty program.
Recommendations For versions prior to 3.6.17, update to version 3.6.17 or later. For versions prior to 3.7.15, update to version 3.7.15 or later. For versions prior to 3.8.8, update to version 3.8.8 or later. For versions prior to 3.9.3, update to version 3.9.3 or later. For versions prior to 3.10.1, update to version 3.10.1 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-697

Identificadores relacionados

CVE-2023-23766

Produtos afetados

Github Enterprise Server