PT-2023-30137 · Github · Github Enterprise Server

Ahacker1 · Published 2023-12-21 · Updated 2024-12-16 · CVE-2023-46646

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.7.0 through 3.17.18 GitHub Enterprise Server versions 3.8.0 through 3.8.11 GitHub Enterprise Server versions 3.9.0 through 3.9.6 GitHub Enterprise Server versions 3.10.0 through 3.10.3

Description The issue is related to improper access control in GitHub Enterprise Server, allowing unauthorized users to view private repository names via the "Get a check run" API endpoint. This does not allow unauthorized access to any repository content besides the name.

Recommendations For GitHub Enterprise Server versions 3.7.0 through 3.17.18, update to version 3.17.19 or later. For GitHub Enterprise Server versions 3.8.0 through 3.8.11, update to version 3.8.12 or later. For GitHub Enterprise Server versions 3.9.0 through 3.9.6, update to version 3.9.7 or later. For GitHub Enterprise Server versions 3.10.0 through 3.10.3, update to version 3.10.4 or later. As a temporary workaround, consider restricting access to the "Get a check run" API endpoint until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-46646

Affected Products

Github Enterprise Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-46646 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46646 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 · Note
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 · Note
• https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 · Note
• https://t.me/cvenotify/65682 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 · Note
• https://t.me/cvenotify/104417 · Telegram Post