CVE-2023-6746: Sensitive Information in Log File in GitHub Enterprise Server
First published: Thu Dec 21 2023(Updated: )
An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | >=3.7.0<3.7.19 | |
| GitHub Enterprise Server | >=3.8.0<3.8.12 | |
| GitHub Enterprise Server | >=3.9.0<3.9.7 | |
| GitHub Enterprise Server | >=3.10.0<3.10.4 | |
| GitHub Enterprise Server | =3.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
Frequently Asked Questions
What is the severity of CVE-2023-6746?
CVE-2023-6746 is classified as a moderate severity vulnerability.
How do I fix CVE-2023-6746?
To fix CVE-2023-6746, upgrade to a non-affected version of GitHub Enterprise Server, specifically versions 3.7.19, 3.8.12, 3.9.7, 3.10.4, or above 3.11.0.
What systems are affected by CVE-2023-6746?
CVE-2023-6746 affects multiple versions of GitHub Enterprise Server including versions 3.7.0 to 3.7.19, 3.8.0 to 3.8.12, 3.9.0 to 3.9.7, and 3.10.0 to 3.10.4, as well as version 3.11.0.
What type of attack can be executed due to CVE-2023-6746?
CVE-2023-6746 can potentially allow for an adversary in the middle attack when combined with other phishing techniques.
What kind of information may be exposed due to CVE-2023-6746?
CVE-2023-6746 involves the insertion of sensitive information into log files, which could be exploited by attackers.
- agent/type
- agent/event
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- vendor/github
- canonical/github enterprise server
- version/github enterprise server/3.7.0
- version/github enterprise server/3.8.0
- version/github enterprise server/3.9.0
- version/github enterprise server/3.10.0
- version/github enterprise server/3.11.0