6.3
Moyenne
CVE-2025-6600 An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an…
Description
An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repositories within an organization. This issue could be exploited by leveraging a user-to-server token with no scopes via the Search API endpoint. Successful exploitation required an organization administrator to install a malicious GitHub App in the organization’s repositories. This vulnerability impacted only GitHub Enterprise Server version 3.17 and was addressed in version 3.17.2. The vulnerability was reported through the GitHub Bug Bounty program.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| GitHub Enterprise Server 3.17 | 3.17.0 → 3.17.1 | Pas de correctif indiqué |
Autres CVE de GitHub Enterprise Server
Les 46 CVE de GitHub Enterprise Server →
CVE-2025-3246
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site…
8.6
Élevée
CVE-2024-9539
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL…
5.7
Moyenne
CVE-2024-8263
An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped…
6.2
Moyenne
CVE-2024-8770
A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise…
5.8
Moyenne