CVE-2022-46258

 

Published at: - 09-01-2023 06:15

Last modified: - 13-01-2023 08:52

Total changes: - 2

Description

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Action Workflow files without a Workflow scope. The Create or Update file contents API should enforce workflow scope. This vulnerability affected all versions of GitHub Enterprise Server prior to version 3.7 and was fixed in versions 3.3.16, 3.4.11, 3.5.8, and 3.6.4. This vulnerability was reported via the GitHub Bug Bounty program.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://docs.github.com/en/enterprise-server@3.3/admin/release-notes#3.3.16
• https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.8
• https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.11
• https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.4

 

Keywords

NVD

 

CVE-2022-46258

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures