Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token

CVE-2023-46648

Summary

A security vulnerability was found in GitHub Enterprise Server that allows attackers to brute-force a pending user invitation to the Management Console. To exploit this vulnerability, an attacker must be aware of the existence of an invitation. This affects all versions of GitHub Enterprise Server from 3.8 to prior versions of 3.8.12, 3.9.7, 3.10.4, and 3.11.1, where security patches have been implemented.

References