Skip to content
OpenAdvisories
Medium WID-SEC-2025-0863 3 CVEs

Microsoft GitHub Enterprise: Mehrere Schwachstellen

Published Apr 21, 2025 · Updated Apr 21, 2025 · de-DE

Vendor: Microsoft Product: GitHub Enterprise

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Informationen offenzulegen, und um beliebigen Programmcode auszuführen.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 3

  • High 8.6
    CVE-2025-3246

    Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers

    An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and …

    GitHub GitHub Enterprise Server
  • High 7.1
    CVE-2025-3509

    Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation

    A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vu…

    GitHub Enterprise Server
  • Medium 5.3
    CVE-2025-3124

    Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names

    A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overvi…

    GitHub Enterprise Server

Revision history

  1. #1

    Initiale Fassung

References