CVE-2023-46646

MEDIUM

GitHub Enterprise Server <3.17.19-3.11.0 - Info Disclosure

Title source: llm
STIX 2.1

Description

Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0.

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0037
EPSS Percentile 59.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
github/enterprise_server 3.7.0 - 3.7.19
Published Dec 21, 2023
Tracked Since Feb 18, 2026