7.2
High
CVE-2022-23741 An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server…
Description
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GitHub Enterprise Server 3.6 | 3.6 → < 3.6.5 | 3.6.5 |
| GitHub Enterprise Server 3.5 | 3.5 → < 3.5.9 | 3.5.9 |
| GitHub Enterprise Server 3.4 | 3.4 → < 3.4.12 | 3.4.12 |
| GitHub Enterprise Server 3.3 | 3.3 → < 3.3.17 | 3.3.17 |
Other CVEs of GitHub Enterprise Server
The 46 CVEs of GitHub Enterprise Server →
CVE-2025-6600
An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an…
6.3
Medium
CVE-2025-3246
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site…
8.6
High
CVE-2024-9539
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL…
5.7
Medium
CVE-2024-8263
An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped…
6.2
Medium