CVE-2022-46256: Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5 and 3.7.2. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-46256?
The severity of CVE-2022-46256 is high with a severity value of 8.8.
How do I fix the CVE-2022-46256 vulnerability?
To fix the CVE-2022-46256 vulnerability, please update GitHub Enterprise Server to version 3.3.17 or higher.
Which versions of GitHub Enterprise Server are affected by CVE-2022-46256?
GitHub Enterprise Server versions up to and including 3.3.17, and versions between 3.4.0 and 3.4.12, 3.5.0 and 3.5.9, 3.6.0 and 3.6.5, 3.7.0 and 3.7.2 are affected by CVE-2022-46256.
What is the CWE classification of CVE-2022-46256?
The CWE classification of CVE-2022-46256 is CWE-22.
Where can I find more information about CVE-2022-46256?
You can find more information about CVE-2022-46256 in the GitHub Enterprise Server release notes: [link](https://docs.github.com/en/enterprise-server@3.3/admin/release-notes#3.3.17), [link](https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.12), [link](https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.9).