PT-2023-32779 · Github · Github Enterprise Server

CVE-2023-6804 · Publicado 2023-12-21 · Atualizado 2023-12-29

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server versions 3.11 through 3.11.0

Description Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped Personal Access Token (PAT). To exploit this, a workflow must have already existed in the target repository.

Recommendations For GitHub Enterprise Server versions 3.8 through 3.8.11, update to version 3.8.12. For GitHub Enterprise Server versions 3.9 through 3.9.6, update to version 3.9.7. For GitHub Enterprise Server versions 3.10 through 3.10.3, update to version 3.10.4. For GitHub Enterprise Server versions 3.11 through 3.11.0, update to version 3.11.1.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2023-6804

Produtos afetados

Github Enterprise Server

Referências · 8

• https://t.me/cvenotify/65739 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-6804 · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/1739950236343107920 · Publicação no Twitter
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 · Nota
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6804 · Nota de Segurança
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 · Nota
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 · Nota