CVE-2023-46649
Assigner: GitHub_P
Published: 2023-12-21T20:45:43.763Z
State: PUBLISHED
affected: defaultStatus: affected
product: Enterprise Server
vendor: GitHub
versions: changes: at: 3.7.19
status: unaffected
lessThanOrEqual: 3.7.18
status: affected
version: 3.7.0
versionType: semver
changes: at: 3.8.12
status: unaffected
lessThanOrEqual: 3.8.11
status: affected
version: 3.8.0
versionType: semver
changes: at: 3.9.7
status: unaffected
lessThanOrEqual: 3.9.6
status: affected
version: 3.9.0
versionType: semver
changes: at: 3.10.4
status: unaffected
lessThanOrEqual: 3.10.3
status: affected
version: 3.10.0
versionType: semver
changes: at: 3.11.1
status: unaffected
lessThanOrEqual: 3.11.0
status: affected
version: 3.11
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user.&nbsp;This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.&nbsp;
value: A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 
impacts: capecId: CAPEC-29
descriptions: value: CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
type: CWE
source: discovery: EXTERNAL
title: Race Condition allows Administrative Access on Organization Repositories
x_generator: engine: Vulnogram 0.1.0-dev