← Back

CVE-2023-46648

nvd nist
Published: Dec 21, 2023Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.6 / Impact: 5.9
Source: NVD

Description

An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.

Affected (4)

Github
1 product
Enterprise Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Github
Enterprise Server
From 3.10.0 to 3.10.4
Enterprise Server
From 3.8.0 to 3.8.12
Enterprise Server
From 3.9.0 to 3.9.7
Enterprise Server
Version 3.11.0

Related CWEs

CWE-331
Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (8)

Source: product-cna@github.com
Release Notes
Source: product-cna@github.com
Release Notes
Source: product-cna@github.com
Release Notes
Source: product-cna@github.com
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes

Timeline

No history available yet.