// For flags

CVE-2023-46647

Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0.

La administración inadecuada de privilegios en todas las versiones de GitHub Enterprise Server permite a los usuarios con acceso autorizado a la consola de administración con un rol de editor escalar sus privilegios al realizar solicitudes al endpoint utilizado para iniciar la instancia. Esta vulnerabilidad afectó a GitHub Enterprise Server versión 3.8.0 y superiores y se solucionó en las versiones 3.8.12, 3.9.6, 3.10.3 y 3.11.0.

*Credits: Imre Rad
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-10-24 CVE Reserved
  • 2023-12-21 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-11-20 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
CAPEC
  • CAPEC-233: Privilege Escalation
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.8.0 < 3.8.12
Search vendor "Github" for product "Enterprise Server" and version " >= 3.8.0 < 3.8.12"
-
Affected
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.9.0 < 3.9.6
Search vendor "Github" for product "Enterprise Server" and version " >= 3.9.0 < 3.9.6"
-
Affected
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.10.0 < 3.10.3
Search vendor "Github" for product "Enterprise Server" and version " >= 3.10.0 < 3.10.3"
-
Affected