PT-2025-17245 · Github · Github Enterprise Server

CVE-2025-3246 · Publicado 2025-04-17 · Atualizado 2025-10-01

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server version 3.16.1

Description An improper neutralization of input issue was identified in GitHub Enterprise Server, allowing cross-site scripting in GitHub Markdown that used $$..$$ math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user interaction with the malicious elements.

Recommendations For version 3.16.1, update to version 3.16.2 to resolve the issue. As a temporary workaround, consider restricting the use of $$..$$ math blocks in GitHub Markdown until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2025-05159

CVE-2025-3246

Produtos afetados

Github Enterprise Server

Referências · 13

• https://osv.dev/vulnerability/CVE-2025-3246 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1913091266817958228 · Publicação no Twitter
• https://twitter.com/OSINTAFRICA89/status/1973396636656193798 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1913310545215672737 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-3246 · Nota de Segurança
• https://twitter.com/threatsbank/status/1913201620944384121 · Publicação no Twitter
• https://t.me/cvedetector/23291 · Publicação no Telegram
• https://t.me/cveNotify/134405 · Publicação no Telegram
• https://t.me/cvetracker/21903 · Publicação no Telegram
• https://twitter.com/fletch_ai/status/1914590049385185606 · Publicação no Twitter
• https://reddit.com/r/GitProtect/comments/1k56gl1/github_patches_vulnerabilities_in_its_enterprise · Publicação no Reddit
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2 · Nota
• https://bdu.fstec.ru/vul/2025-05159 · Nota de Segurança