Information disclosure in Github Enterprise Server
CVE-2023-6746
An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techn…
EPSS: 0.002 (39.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Github Enterprise Server — versions 3.7.0, 3.8.0, 3.9.0
Weakness classification (CWE)
References
- docs.github.com/en/enterprise-server@3.7/admin/release-notes
- docs.github.com/en/enterprise-server@3.8/admin/release-notes
- docs.github.com/en/enterprise-server@3.9/admin/release-notes
- docs.github.com/en/enterprise-server@3.10/admin/release-notes
- docs.github.com/en/enterprise-server@3.11/admin/release-notes
Frequently asked questions
- What is CVE-2023-6746?
- CVE-2023-6746 is a high-severity vulnerability in Github Enterprise Server, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.1/10. Published 2023-12-21.
- How severe is CVE-2023-6746?
- High severity. CVSS v3 base score is 8.1 out of 10.