CVE-2023-46646
First published: Thu Dec 21 2023(Updated: )
Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise | >=3.7.0<3.7.19 | |
| GitHub Enterprise | >=3.8.0<3.8.12 | |
| GitHub Enterprise | >=3.9.0<3.9.7 | |
| GitHub Enterprise | >=3.10.0<3.10.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
Frequently Asked Questions
What is the severity of CVE-2023-46646?
CVE-2023-46646 is considered a medium severity vulnerability due to improper access control allowing unauthorized users to view private repository names.
How do I fix CVE-2023-46646?
To fix CVE-2023-46646, you should upgrade to the latest version of GitHub Enterprise Server that addresses this vulnerability.
Which versions of GitHub Enterprise Server are affected by CVE-2023-46646?
CVE-2023-46646 affects GitHub Enterprise Server versions between 3.7.0 and 3.7.19, 3.8.0 and 3.8.12, 3.9.0 and 3.9.7, and 3.10.0 and 3.10.4.
Can CVE-2023-46646 lead to unauthorized access of repository content?
No, CVE-2023-46646 only allows unauthorized users to view the names of private repositories and not their actual content.
What should I do if I cannot immediately update to fix CVE-2023-46646?
If immediate updating is not possible, review your access controls and limit visibility to the 'Get a check run' API endpoint to mitigate risks associated with CVE-2023-46646.
- agent/references
- agent/type
- agent/event
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/github
- canonical/github enterprise
- version/github enterprise/3.7.0
- version/github enterprise/3.8.0
- version/github enterprise/3.9.0
- version/github enterprise/3.10.0