Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

CVE-2023-23764
4.8MEDIUM

Key Information

Vendor
Github
Status
Enterprise Server
Vendor
CVE Published:
27 July 2023

Summary

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server versions 3.7.0 and above and was fixed in versions 3.7.9, 3.8.2, and 3.9.1. This vulnerability was reported via the GitHub Bug Bounty program.

Affected Version(s)

Enterprise Server < 3.7.9

Enterprise Server < 3.8.2

Enterprise Server < 3.9.1

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Risk change from: 7.1 to: 4.8 - (MEDIUM)

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

inspector-ambitious
.