CVE-2025-23369: Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23369?
CVE-2025-23369 has a medium severity level, indicating a moderate impact on security.
How do I fix CVE-2025-23369?
To fix CVE-2025-23369, update GitHub Enterprise Server to a version later than 3.15.2.
Who is affected by CVE-2025-23369?
CVE-2025-23369 affects instances of GitHub Enterprise Server versions earlier than 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0.
What is the nature of the vulnerability in CVE-2025-23369?
The vulnerability in CVE-2025-23369 is an improper verification of cryptographic signature that allows for signature spoofing.
Does CVE-2025-23369 affect users using SAML single sign-on?
No, CVE-2025-23369 primarily affects unauthorized internal users not utilizing SAML single sign-on.