CVE-2023-6690
Assigner: GitHub_P
Published: 2023-12-21T20:45:19.285Z
State: PUBLISHED
affected: defaultStatus: affected
product: Enterprise Server
vendor: GitHub
versions: changes: at: 3.8.12
status: unaffected
lessThanOrEqual: 3.8.11
status: affected
version: 3.8
versionType: semver
changes: at: 3.9.7
status: unaffected
lessThanOrEqual: 3.9.6
status: affected
version: 3.9
versionType: semver
changes: at: 3.10.4
status: unaffected
lessThanOrEqual: 3.10.3
status: affected
version: 3.10
versionType: semver
changes: at: 3.11.1
status: unaffected
lessThanOrEqual: 3.11.0
status: affected
version: 3.11
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: inspector-ambitious
descriptions: supportingMedia: base64: no
type: text/html
value: A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer.&nbsp;<span style="background-color: var(--wht);">This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.</span><br>
value: A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

impacts: capecId: CAPEC-29
descriptions: value: CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev