CVE-2023-46649CWE-367

Race Condition allows Administrative Access on Organization Repositories

Medium · published December 21, 2023

CVSS v3.1
6.3
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.6th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2023-12-21T20:45Z
EPSS history
Timeline
  • 21 DEC 20:45Z
    Race Condition allows Administrative Access on Organization Repositories
    cvelistv5