← Back

CVE-2022-23741

nvd nist
Published: Dec 14, 2022Modified: Apr 22, 2025

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.

Affected (4)

Github
1 product
Enterprise Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Github
Enterprise Server
Before 3.3.17
Enterprise Server
From 3.4.0 to 3.4.12
Enterprise Server
From 3.5.0 to 3.5.9
Enterprise Server
From 3.6.0 to 3.6.5

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (8)

Source: product-cna@github.com
Source: product-cna@github.com
Source: product-cna@github.com
Source: product-cna@github.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.