CVE-2023-46649: Race Condition allows Administrative Access on Organization Repositories
First published: Thu Dec 21 2023(Updated: )
A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | >=3.7.0<3.7.19 | |
| GitHub Enterprise Server | >=3.8.0<3.8.12 | |
| GitHub Enterprise Server | >=3.9.0<3.9.7 | |
| GitHub Enterprise Server | >=3.10.0<3.10.4 | |
| GitHub Enterprise Server | =3.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
Frequently Asked Questions
What is the severity of CVE-2023-46649?
CVE-2023-46649 is classified with a high severity due to the potential for an attacker to gain administrator access.
How do I fix CVE-2023-46649?
To fix CVE-2023-46649, you must upgrade GitHub Enterprise Server to version 3.7.19 or later, 3.8.12 or later, 3.9.7 or later, 3.10.4 or later, or 3.11.0.
Which versions of GitHub Enterprise Server are affected by CVE-2023-46649?
CVE-2023-46649 affects all versions of GitHub Enterprise Server from 3.7.0 up to but not including version 3.7.19, and various versions up to their respective fixes.
Can CVE-2023-46649 be exploited without user conversion?
Exploitation of CVE-2023-46649 requires the organization to be converted from a user to allow the race condition to be triggered.
What is the nature of CVE-2023-46649?
CVE-2023-46649 is a race condition vulnerability that can lead to unauthorized administrator access in GitHub Enterprise Server.
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/source
- vendor/github
- canonical/github enterprise server
- version/github enterprise server/3.7.0
- version/github enterprise server/3.8.0
- version/github enterprise server/3.9.0
- version/github enterprise server/3.10.0
- version/github enterprise server/3.11.0