CVE-2023-6746
Description
An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
How to fix
- github enterprise_server3.7.19, 3.8.12, 3.9.7, 3.10.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github enterprise_server | 3.7.0 ≤ v < 3.7.19, 3.8.0 ≤ v < 3.8.12, 3.9.0 ≤ v < 3.9.7, 3.10.0 ≤ v < 3.10.4, 3.11.0 | 3.7.19, 3.8.12, 3.9.7, 3.10.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.