PT-2023-12733 · Github · Github Enterprise Server

Ahacker1 · Published 2023-01-17 · Updated 2025-04-08 · CVE-2022-23739

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.7.1

Description An incorrect authorization issue was identified, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This issue enabled an app installed on an organization to access and modify most organization-level resources not tied to a repository, such as users and organization-wide projects, regardless of granted permissions. Resources associated with repositories, like repository file content, repository-specific projects, issues, or pull requests, were not impacted. The issue was reported via the GitHub Bug Bounty program.

Recommendations For GitHub Enterprise Server versions prior to 3.3.16, update to version 3.3.16 or later. For GitHub Enterprise Server versions 3.3.x, update to version 3.3.16 or later. For GitHub Enterprise Server versions 3.4.x, update to version 3.4.11 or later. For GitHub Enterprise Server versions 3.5.x, update to version 3.5.8 or later. For GitHub Enterprise Server versions 3.6.x, update to version 3.6.4 or later. For GitHub Enterprise Server versions prior to 3.7.1, update to version 3.7.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-23739

Affected Products

Github Enterprise Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-23739 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23739 · Vendor Advisory
• https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.8 · Note
• https://t.me/cvenotify/118384 · Telegram Post
• https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1 · Note
• https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.4 · Note
• https://t.me/cibsecurity/56607 · Telegram Post
• https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.11 · Note
• https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.16 · Note
• https://t.me/cvenotify/42176 · Telegram Post