CVE-2023-6804: Improper Privilege Management allows for arbitrary workflows to be run
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6804?
CVE-2023-6804 is considered a high severity vulnerability due to its potential to allow arbitrary workflows to be executed.
How do I fix CVE-2023-6804?
To mitigate CVE-2023-6804, upgrade to GitHub Enterprise Server versions 3.8.12, 3.9.7, 3.10.4, or 3.11.0.
Who is affected by CVE-2023-6804?
CVE-2023-6804 affects all versions of GitHub Enterprise Server from 3.8.0 up to 3.11.0.
What is the nature of the vulnerability in CVE-2023-6804?
CVE-2023-6804 involves improper privilege management which can lead to unauthorized execution of workflows.
Can CVE-2023-6804 be exploited without prior access?
Exploitation of CVE-2023-6804 requires that an arbitrary workflow already exists in the target repository.