CVE-2022-23733 - Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes

Back Back to CVE browser

MEDIUM

Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes

Published Aug 2, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products

Vendor GitHub Product GitHub Enterprise Server Default
n/a
- Version
  3.3
  Status
  affected
  Constraints
  <3.3.11
- Version
  3.4
  Status
  affected
  Constraints
  <3.4.6
- Version
  3.5
  Status
  affected
  Constraints
  <3.5.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitHub

GitHub Enterprise Server

n/a

Version	Status	Constraints
3.3	affected	<3.3.11
3.4	affected	<3.4.6
3.5	affected	<3.5.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.11
x_refsource_MISC
https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.6
x_refsource_MISC
https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.3
x_refsource_MISC

Link	Providers	Tags
https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.11		x_refsource_MISC
https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.6		x_refsource_MISC
https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.3		x_refsource_MISC