CVE-2023-46645 MEDIUM

CVE-2023-46645: Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site

Vendor Github
Product Enterprise Server
Weakness CWE-22 · Path traversal
Published December 21, 2023
Last update September 13, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.

Key dates

02Disclosure timeline

December 21, 2023 CVE published
September 13, 2024 Record updated