Information disclosure in Github Enterprise Server
CVE-2023-6802
An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Github Enterprise Server — versions 3.8.0, 3.9.0, 3.10.0
- Github Enterprise_server — versions 3.11.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- product-cna@github.com (Release Notes)
- product-cna@github.com (Release Notes)
- product-cna@github.com (Release Notes)
- product-cna@github.com (Release Notes)
Frequently asked questions
- What is CVE-2023-6802?
- CVE-2023-6802 is a high-severity vulnerability in Github Enterprise Server, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.2/10. Published 2023-12-21.
- How severe is CVE-2023-6802?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2023-6802 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.