PT-2023-30140 · Github · Github Enterprise Server

CVE-2023-46649 · Publicado 2023-12-21 · Atualizado 2023-12-29

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.7 through 3.7.18 GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server versions 3.11 through 3.11.0

Description A race condition in GitHub Enterprise Server could allow an attacker to gain administrator access. This can be exploited when an organization is converted from a user.

Recommendations For GitHub Enterprise Server versions 3.7 through 3.7.18, update to version 3.7.19. For GitHub Enterprise Server versions 3.8 through 3.8.11, update to version 3.8.12. For GitHub Enterprise Server versions 3.9 through 3.9.6, update to version 3.9.7. For GitHub Enterprise Server versions 3.10 through 3.10.3, update to version 3.10.4. For GitHub Enterprise Server versions 3.11 through 3.11.0, update to version 3.11.1.

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

CVE-2023-46649

Produtos afetados

Github Enterprise Server

Referências · 9

• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 · Nota
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 · Nota
• https://osv.dev/vulnerability/CVE-2023-46649 · Aviso do Fabricante
• https://t.me/cvenotify/64764 · Publicação no Telegram
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 · Nota
• https://t.me/cvenotify/65685 · Publicação no Telegram
• https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 · Nota
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-46649 · Nota de Segurança