// For flags

CVE-2023-46649

Race Condition allows Administrative Access on Organization Repositories

Severity Score

7.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

Se identificó una condición de ejecución en GitHub Enterprise Server que podría permitir el acceso de administrador a un atacante. Para aprovechar esto, una organización debe ser convertida desde un usuario. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server desde la 3.7 y se solucionó en las versiones 3.7.19, 3.8.12, 3.9.7, 3.10.4 y 3.11.1.

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-10-24 CVE Reserved
  • 2023-12-21 CVE Published
  • 2024-08-02 CVE Updated
  • 2025-04-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CAPEC
  • CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.7.0 < 3.7.19
Search vendor "Github" for product "Enterprise Server" and version " >= 3.7.0 < 3.7.19"
-
Affected
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.8.0 < 3.8.12
Search vendor "Github" for product "Enterprise Server" and version " >= 3.8.0 < 3.8.12"
-
Affected
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.9.0 < 3.9.7
Search vendor "Github" for product "Enterprise Server" and version " >= 3.9.0 < 3.9.7"
-
Affected
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 >= 3.10.0 < 3.10.4
Search vendor "Github" for product "Enterprise Server" and version " >= 3.10.0 < 3.10.4"
-
Affected
Github
Search vendor "Github"
 Enterprise Server
Search vendor "Github" for product "Enterprise Server"
 3.11.0
Search vendor "Github" for product "Enterprise Server" and version "3.11.0"
-
Affected