CVE-2023-46648
Assigner: GitHub_P
Published: 2023-12-21T20:45:45.845Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Enterprise Server
vendor: GitHub
versions: lessThan: 3.8.12
status: affected
version: 3.8.0
versionType: semver
lessThan: 3.9.7
status: affected
version: 3.9.0
versionType: semver
lessThan: 3.10.4
status: affected
version: 3.10.0
versionType: semver
lessThan: 3.11.1
status: affected
version: 3.11.0
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Imre Rad
descriptions: supportingMedia: base64: no
type: text/html
value: An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.<br>
value: An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.

impacts: capecId: CAPEC-112
descriptions: value: CAPEC-112 Brute Force
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-331
description: CWE-331 Insufficient Entropy
type: CWE
source: discovery: EXTERNAL
title: Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token
x_generator: engine: Vulnogram 0.1.0-dev