CVE-2022-23733

CVE-2022-23733: Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes

Vendor Github
Product GitHub Enterprise Server
Weakness CWE-79 · XSS
Published August 2, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program.

Key dates

02Disclosure timeline

August 2, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-40552 WordPress Fitness calculators plugin Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS) CVE-2024-12921 EthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode CVE-2024-51711 WordPress Saragna plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-42045 LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) CVE-2025-58703 WordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) Vulnerability