// For flags

CVE-2025-6600

GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API

Severity Score

6.3
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repositories within an organization. This issue could be exploited by leveraging a user-to-server token with no scopes via the Search API endpoint. Successful exploitation required an organization administrator to install a malicious GitHub App in the organization’s repositories. This vulnerability impacted only GitHub Enterprise Server version 3.17 and was addressed in version 3.17.2. The vulnerability was reported through the GitHub Bug Bounty program.

Se identificó una vulnerabilidad de exposición de información confidencial en GitHub Enterprise Server que podría permitir a un atacante divulgar los nombres de repositorios privados dentro de una organización. Este problema podría explotarse mediante un token de usuario a servidor sin alcances a través del endpoint de la API de búsqueda. Para explotarlo con éxito, el administrador de la organización tuvo que instalar una aplicación maliciosa de GitHub en los repositorios de la organización. Esta vulnerabilidad afectó únicamente a la versión 3.17 de GitHub Enterprise Server y se solucionó en la versión 3.17.2. La vulnerabilidad se reportó a través del programa de recompensas por errores de GitHub.

*Credits: Kyle Carberry, Ammar Bandukwala
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
Low
Low
Integrity
None
None
Availability
None
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2025-06-25 CVE Reserved
  • 2025-07-01 CVE Published
  • 2025-07-01 CVE Updated
  • 2025-07-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
  • CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
GitHub
Search vendor "GitHub"
 GitHub Enterprise Server
Search vendor "GitHub" for product "GitHub Enterprise Server"
 >= 3.17.0 <= 3.17.1
Search vendor "GitHub" for product "GitHub Enterprise Server" and version " >= 3.17.0 <= 3.17.1"
en
Affected