CVE-2023-51379

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-51379
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 Release Notes
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 Release Notes
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 Release Notes
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:3.11.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:37

Type Values Removed Values Added
Summary (es) Se identificó una vulnerabilidad de autorización incorrecta en GitHub Enterprise Server que permitía actualizar los comentarios del problema con un token con un alcance incorrecto. Esta vulnerabilidad no permitía el acceso no autorizado a ningún contenido del repositorio, ya que también requería permisos de contenido: escritura y problemas: lectura. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server desde la 3.7 y se solucionó en las versiones 3.17.19, 3.8.12, 3.9.7, 3.10.4 y 3.11.1. (es) Se identificó una vulnerabilidad de autorización incorrecta en GitHub Enterprise Server que permitía actualizar los comentarios del problema con un token con un alcance incorrecto. Esta vulnerabilidad no permitía el acceso no autorizado a ningún contenido del repositorio, ya que también requería permisos de contenido: problemas de lectura y escritura. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server desde la 3.7 y se solucionó en las versiones 3.17.19, 3.8.12, 3.9.7, 3.10.4 y 3.11.1.
References () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - Release Notes () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 - Release Notes () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 - Release Notes () https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - Release Notes () https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - Release Notes () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - Release Notes

29 Dec 2023, 15:30

Type Values Removed Values Added
References () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 - () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 - () https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - () https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - Release Notes
CPE cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:3.11.0:*:*:*:*:*:*:*
First Time Github
Github enterprise Server

22 Dec 2023, 12:18

Type Values Removed Values Added
Summary
  • (es) Se identificó una vulnerabilidad de autorización incorrecta en GitHub Enterprise Server que permitía actualizar los comentarios del problema con un token con un alcance incorrecto. Esta vulnerabilidad no permitía el acceso no autorizado a ningún contenido del repositorio, ya que también requería permisos de contenido: escritura y problemas: lectura. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server desde la 3.7 y se solucionó en las versiones 3.17.19, 3.8.12, 3.9.7, 3.10.4 y 3.11.1.

21 Dec 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-21 21:15

Updated : 2024-12-16 19:07

NVD link : CVE-2023-51379

Mitre link : CVE-2023-51379

CVE.ORG link : CVE-2023-51379

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-863

Incorrect Authorization