CVE-2023-6804 | BDVDB-2026-220130 Detail
GitHubEnterprise Server
Description#
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Impact#
CAPEC-233 Privilege Escalation
Weaknesses#
- CWE-269 Improper Privilege Management
References#
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.