Vulnerability Details : CVE-2022-23740
CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.
Vulnerability category: Execute code
Products affected by CVE-2022-23740
- cpe:2.3:a:github:enterprise_server:3.7.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-23740
0.22%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-23740
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2022-23740
-
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.Assigned by:
- nvd@nist.gov (Primary)
- product-cna@github.com (Secondary)
References for CVE-2022-23740
-
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.1
Release notes - GitHub Enterprise Server 3.7 DocsRelease Notes;Third Party Advisory
Jump to