Race Condition in GitHub Enterprise Server Impacts Repository Permissions
CVE-2023-6690
3.9LOW
What is CVE-2023-6690?
A race condition in GitHub Enterprise Server allows an existing administrator to retain permissions on repositories that are transferred. By executing a GraphQL mutation to modify repository permissions during the transfer process, the vulnerability enables unauthorized manipulation of user access rights. This issue affects versions 3.8.0 and later but has been resolved in updates 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Enterprise Server 3.8 <= 3.8.11
Enterprise Server 3.8 <= 3.8.11
Enterprise Server 3.9 <= 3.9.6
References
CVSS V3.1
Score:
3.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
inspector-ambitious