Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling
Vulnerability Description
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To exploit this vulnerability, an attacker would need write access to the repository. This vulnerability was reported via the GitHub Bug Bounty Program https://bounty.github.com/ .
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23765
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- inspector-amibitious
References
- https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.16
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.13
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.9
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.1
More from GitHub
View All →Affected Vendor
GitHub
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.