Vulnerability in Github Enterprise Server
CVE-2023-6690
A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
EPSS: 0.003 (25.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L.
Affected products
- Github Enterprise Server — versions 3.8, 3.9, 3.10
- Github Enterprise_server — versions 3.11.0
Weakness classification (CWE)
References
- product-cna@github.com (Release Notes)
- product-cna@github.com (Release Notes)
- product-cna@github.com (Release Notes)
- product-cna@github.com (Release Notes)
Frequently asked questions
- What is CVE-2023-6690?
- CVE-2023-6690 is a low-severity vulnerability in Github Enterprise Server, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 3.9/10. Published 2023-12-21.
- How severe is CVE-2023-6690?
- Low severity. CVSS v3 base score is 3.9 out of 10.