CVE-2022-23741
Assigner: GitHub_P
Published: 2022-12-14T00:00:00
State: PUBLISHED
title: Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access
descriptions: value: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.
affected: vendor: GitHub
product: GitHub Enterprise Server
versions: version: 3.3
status: affected
lessThan: 3.3.17
versionType: custom
version: 3.4
status: affected
lessThan: 3.4.12
versionType: custom
version: 3.5
status: affected
lessThan: 3.5.9
versionType: custom
version: 3.6
status: affected
lessThan: 3.6.5
versionType: custom
credits: value: Vaibhav Singh (@vaib25vicky)
problemTypes: descriptions: type: CWE
description: CWE-863
cweId: CWE-863
source: discovery: EXTERNAL