CVE-2023-46647CWE-269

Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation

High · published December 21, 2023

CVSS v3.1
8.0
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00638 · 49.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-12-21T20:45Z
EPSS history
Timeline
  • 21 DEC 20:45Z
    Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation
    cvelistv5