Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um Berechtigungen zu erweitern, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher bezeichnete Angriffe durchzuführen.
Product
GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.
Vulnerabilities 3
-
Critical 10.0
Redis Lua Use-After-Free may lead to remote code execution
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…
-
High 8.6
DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful explo…
-
High 7.5
Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious re…
Revision history
-
#1
Initiale Fassung
References
-
Enterprise Server release notes vom 2025-11-10
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.1
-
Enterprise Server release notes vom 2025-11-10
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.7
-
Enterprise Server release notes vom 2025-11-10
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.10
-
Enterprise Server release notes vom 2025-11-10
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.14
-
Enterprise Server release notes vom 2025-11-10
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.19