Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2023-23764

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_P

Description

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server versions 3.7.0 and above and was fixed in versions 3.7.9, 3.8.2, and 3.9.1. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GitHub Enterprise Server

Default version status: unaffected

  • 3.7.0 to < 3.7.9affected
  • 3.8.0 to < 3.8.2affected
  • 3.9.0 to < 3.9.1affected

References