CVE-2022-23740

HIGH

8.8

Description

CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published11/23/2022

Last Modified4/28/2025

Sourcenvd

Honeypot Sightings0

Affected Products

github:enterprise_server

Weaknesses (CWE)

CWE-88CWE-88

References

https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1(product-cna@github.com)

https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.