CVEvulnerability

CVE-2023-46649

7.0 HIGH Published 2023-12-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-367

Description

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 

Affected configurations

• github enterprise server (>= 3.7.0 < 3.7.19) • github enterprise server (>= 3.8.0 < 3.8.12) • github enterprise server (>= 3.9.0 < 3.9.7) • github enterprise server (>= 3.10.0 < 3.10.4) • github enterprise server 3.11.0

Related

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References