CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23760 – Path traversal in GitHub Enterprise Server leading to remote code execution
https://notcve.org/view.php?id=CVE-2023-23760
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program. • https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.17 https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.14 https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.10 https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.7 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-46257 – Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names
https://notcve.org/view.php?id=CVE-2022-46257
An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program. • https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17 https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12 https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9 https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-22381 – Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions
https://notcve.org/view.php?id=CVE-2023-22381
A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. To exploit this vulnerability, an attacker would need existing permission to control the value of environment variables for use with GitHub Actions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.8.0 and was fixed in versions 3.4.15, 3.5.12, 3.6.8, 3.7.5. This vulnerability was reported via the GitHub Bug Bounty program. • https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.15 https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.12 https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.8 https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.5 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22380 – Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site
https://notcve.org/view.php?id=CVE-2023-22380
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.6. This vulnerability was reported via the GitHub Bug Bounty program. • https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.6 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-22486 – cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service
https://notcve.org/view.php?id=CVE-2023-22486
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7. cmark-gfm es la bifurcación de GitHub de cmark, una librería y programa de análisis y representación de CommonMark en C. Las versiones anteriores a 0.29.0.gfm.7 contienen un problema de complejidad de tiempo polinomial en handle_close_bracket que puede provocar un agotamiento ilimitado de los recursos y una posterior denegación de servicio. Esta vulnerabilidad ha sido parcheada en 0.29.0.gfm.7. • https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p • CWE-400: Uncontrolled Resource Consumption CWE-407: Inefficient Algorithmic Complexity •