What is CVE-2023-6847?

CVE-2023-6847 is a high-severity vulnerability in Github Enterprise Server, classified under Improper Authentication. CVSS score: 7.5/10. Published 2023-12-21.

How severe is CVE-2023-6847?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Github Enterprise Server

CVE-2023-6847

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API request. To exploit this vulnerability, an attacker would need network access to the Enterprise Server appliance configured in Private Mode. This vulnerability affected all versions of GitHub Enterprise Server since 3.9 and was fixed in version 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.

Vulnerability class: Broken Authentication

EPSS: 0.008 (53.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Github Enterprise Server — versions 3.9.0, 3.10.0, 3.11.0
Github Enterprise_server — versions 3.11.0

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

product-cna@github.com (Release Notes)
product-cna@github.com (Release Notes)
product-cna@github.com (Release Notes)

Frequently asked questions

What is CVE-2023-6847?: CVE-2023-6847 is a high-severity vulnerability in Github Enterprise Server, classified under Improper Authentication. CVSS score: 7.5/10. Published 2023-12-21.
How severe is CVE-2023-6847?: High severity. CVSS v3 base score is 7.5 out of 10.