6.3
Medium
CVE-2025-6600 An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an…
Description
An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repositories within an organization. This issue could be exploited by leveraging a user-to-server token with no scopes via the Search API endpoint. Successful exploitation required an organization administrator to install a malicious GitHub App in the organization’s repositories. This vulnerability impacted only GitHub Enterprise Server version 3.17 and was addressed in version 3.17.2. The vulnerability was reported through the GitHub Bug Bounty program.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GitHub Enterprise Server 3.17 | 3.17.0 → 3.17.1 | No fix stated |
Other CVEs of GitHub Enterprise Server
The 46 CVEs of GitHub Enterprise Server →
CVE-2025-3246
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site…
8.6
High
CVE-2024-9539
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL…
5.7
Medium
CVE-2024-8263
An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped…
6.2
Medium
CVE-2024-8770
A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise…
5.8
Medium