Enterprise Server vulnerabilities
56 known vulnerabilities in Enterprise Server from GitHub. 56 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
Enterprise Server: Use After Free
A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalid
- 8.8 High severity
Enterprise Server: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code ex
- 9.8 Critical severity
Enterprise Server: Observable Timing Discrepancy
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to in
- 8.8 High severity
Enterprise Server: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redi
- 7.5 High severity
Enterprise Server: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload reques
- 7.4 High severity
Enterprise Server: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed
- 7.5 High severity
Enterprise Server: Uncontrolled Recursion
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST reque
- 9.1 Critical severity
Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets
- 8.6 High severity
Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/wor
- 8.2 High severity
Enterprise Server: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting
- 9.8 Critical severity
Enterprise Server: Interpretation Conflict
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library.
- 7.5 High severity
Enterprise Server: Allocation of Resources Without Limits or Throttling
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint pars
- 8.9 High severity
Enterprise Server: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. Whe
- 9.6 Critical severity
Enterprise Server: Authorization Bypass Through User-Controlled Key
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations,
- 8.8 High severity
Enterprise Server: Incorrect Regular Expression
An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a mal
- 8.8 High severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push
- 9.0 Critical severity
Enterprise Server: URL Redirection to Untrusted Site
An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving t
- 9.6 Critical severity
Enterprise Server: Improper Neutralization of Input During Web Page Generation
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploi
- 7.2 High severity
Enterprise Server: Improper Link Resolution Before File Access
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious rep
- 7.2 High severity
Enterprise Server: Improper Control of Generation of Code
A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vul
- 7.6 High severity
GitHub Enterprise Server: Improper Neutralization of Input During Web Page Generation
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and p
- 7.1 High severity
Enterprise Server: Improper Control of Generation of Code
A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by man
- 8.8 High severity
Enterprise Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an ex
- 9.1 Critical severity
Enterprise Server: Improper Link Resolution Before File Access
A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administrator access to the G
- 9.1 Critical severity
Enterprise Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required t
- 9.8 Critical severity
GitHub Enterprise Server: Improper Verification of Cryptographic Signature
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct
- 7.2 High severity
GitHub Enterprise Server: Server-Side Request Forgery
A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authent
- 9.8 Critical severity
Enterprise Server: Incorrect Implementation of Authentication Algorithm
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provi
- 7.2 High severity
Enterprise Server: Improper Neutralization of Argument Delimiters in a Command
A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Ex
- 7.2 High severity
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an…
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerabili
- 7.2 High severity
Enterprise Server: Improper Privilege Management
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for a
- 7.2 High severity
An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access…
An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.
- 7.2 High severity
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an…
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring SMTP options. Exploitation of thi
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring audit log forwarding. Exploitatio
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring SAML settings. Exploitation of this vulnerability req
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collectd configurations. Ex
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting up an HTTP proxy. Exploitation of this vulnerability requ
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL.
- 8.0 High severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the `syslog-ng` configuration file. Exploitation of this vulnerabi