CVE-2023-23764
Assigner: GitHub_P
Published: 2023-07-27T20:45:19.973Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Enterprise Server
vendor: GitHub
versions: lessThan: 3.7.9
status: affected
version: 3.7.0
versionType: 3.7.9
lessThan: 3.8.2
status: affected
version: 3.8.0
versionType: 3.8.2
lessThan: 3.9.1
status: affected
version: 3.9.0
versionType: 3.9.1
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: inspector-ambitious
descriptions: supportingMedia: base64: no
type: text/html
value: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server versions 3.7.0 and above and was fixed in versions 3.7.9, 3.8.2, and 3.9.1. This vulnerability was reported via the GitHub Bug Bounty program.<br><br>
value: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server versions 3.7.0 and above and was fixed in versions 3.7.9, 3.8.2, and 3.9.1. This vulnerability was reported via the GitHub Bug Bounty program.


impacts: descriptions: value: CWE-697
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-697
description: CWE-697
type: CWE
source: discovery: EXTERNAL
title: Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling
x_generator: engine: Vulnogram 0.1.0-dev