Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data

CVE-2023-6847

Summary

An improper authentication vulnerability was found in GitHub Enterprise Server, which permits the bypass of Private Mode through a specially crafted API request. This vulnerability is particularly concerning as it necessitates only network access to the Enterprise Server appliance set to Private Mode. It affects all versions from 3.9 and has been addressed in updates 3.9.7, 3.10.4, and 3.11.1. The issue was reported via the GitHub Bug Bounty program, emphasizing the importance of community engagement in cybersecurity.

References