CVE-2023-6802

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6802
An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:3.11.0:*:*:*:*:*:*:*
History

29 Dec 2023, 19:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.2 		v2 : unknown
v3 : 6.5
References () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - () https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 - () https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - () https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - () https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - Release Notes
First Time Github enterprise Server
Github
CPE cpe:2.3:a:github:enterprise_server:3.11.0:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*

22 Dec 2023, 12:18

Type Values Removed Values Added
Summary
  • (es) Se identificó una inserción de información confidencial en el archivo de registro del registro de auditoría en GitHub Enterprise Server que podría permitir que un atacante obtenga acceso a la consola de administración. Para explotar esto, un atacante necesitaría acceso a los archivos de registro del dispositivo GitHub Enterprise Server, un archivo de respaldo creado con GitHub Enterprise Server Backup Utilities o un servicio que recibiera registros transmitidos. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server desde la 3.8 y se solucionó en las versiones 3.8.12, 3.9.7, 3.10.4 y 3.11.1.

21 Dec 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-21 21:15

Updated : 2023-12-29 19:17

NVD link : CVE-2023-6802

Mitre link : CVE-2023-6802

CVE.ORG link : CVE-2023-6802

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-532

Insertion of Sensitive Information into Log File