Vulnerability Details CVE-2023-6690
A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 16.4%
CVSS Severity
CVSS v3 Score 3.9
References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
Products affected by CVE-2023-6690
-
cpe:2.3:a:github:enterprise_server:3.10.0
-
cpe:2.3:a:github:enterprise_server:3.10.1
-
cpe:2.3:a:github:enterprise_server:3.10.2
-
cpe:2.3:a:github:enterprise_server:3.10.3
-
cpe:2.3:a:github:enterprise_server:3.11.0
-
cpe:2.3:a:github:enterprise_server:3.8.0
-
cpe:2.3:a:github:enterprise_server:3.8.1
-
cpe:2.3:a:github:enterprise_server:3.8.10
-
cpe:2.3:a:github:enterprise_server:3.8.11
-
cpe:2.3:a:github:enterprise_server:3.8.2
-
cpe:2.3:a:github:enterprise_server:3.8.3
-
cpe:2.3:a:github:enterprise_server:3.8.4
-
cpe:2.3:a:github:enterprise_server:3.8.5
-
cpe:2.3:a:github:enterprise_server:3.8.6
-
cpe:2.3:a:github:enterprise_server:3.8.7
-
cpe:2.3:a:github:enterprise_server:3.8.8
-
cpe:2.3:a:github:enterprise_server:3.8.9
-
cpe:2.3:a:github:enterprise_server:3.9.0
-
cpe:2.3:a:github:enterprise_server:3.9.1
-
cpe:2.3:a:github:enterprise_server:3.9.2
-
cpe:2.3:a:github:enterprise_server:3.9.3
-
cpe:2.3:a:github:enterprise_server:3.9.4
-
cpe:2.3:a:github:enterprise_server:3.9.5
-
cpe:2.3:a:github:enterprise_server:3.9.6