PT-2023-19191 · Github · Github Enterprise Server
Inspector-Amibitious
·
Published
2023-09-22
·
Updated
2023-09-25
·
CVE-2023-23766
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
GitHub Enterprise Server versions prior to 3.6.17
GitHub Enterprise Server versions prior to 3.7.15
GitHub Enterprise Server versions prior to 3.8.8
GitHub Enterprise Server versions prior to 3.9.3
GitHub Enterprise Server versions prior to 3.10.1
Description
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To exploit this issue, an attacker would need write access to the repository. This vulnerability was reported via the GitHub Bug Bounty program.
Recommendations
For versions prior to 3.6.17, update to version 3.6.17 or later.
For versions prior to 3.7.15, update to version 3.7.15 or later.
For versions prior to 3.8.8, update to version 3.8.8 or later.
For versions prior to 3.9.3, update to version 3.9.3 or later.
For versions prior to 3.10.1, update to version 3.10.1 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Github Enterprise Server