CVE-2023-46646: Medium severity github enterprise vulnerability
Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46646?
CVE-2023-46646 is considered a medium severity vulnerability due to improper access control allowing unauthorized users to view private repository names.
How do I fix CVE-2023-46646?
To fix CVE-2023-46646, you should upgrade to the latest version of GitHub Enterprise Server that addresses this vulnerability.
Which versions of GitHub Enterprise Server are affected by CVE-2023-46646?
CVE-2023-46646 affects GitHub Enterprise Server versions between 3.7.0 and 3.7.19, 3.8.0 and 3.8.12, 3.9.0 and 3.9.7, and 3.10.0 and 3.10.4.
Can CVE-2023-46646 lead to unauthorized access of repository content?
No, CVE-2023-46646 only allows unauthorized users to view the names of private repositories and not their actual content.
What should I do if I cannot immediately update to fix CVE-2023-46646?
If immediate updating is not possible, review your access controls and limit visibility to the 'Get a check run' API endpoint to mitigate risks associated with CVE-2023-46646.