CVE-2023-6804: Improper Privilege Management allows for arbitrary workflows to be run
6.5
CVSS
Description
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Classification
CVE ID: CVE-2023-6804
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
Affected Products
Vendor: GitHub
Product: Enterprise Server
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.81% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://docs.github.com/en/[email protected]/admin/release-notes#3.8.12https://docs.github.com/en/[email protected]/admin/release-notes#3.9.7
https://docs.github.com/en/[email protected]/admin/release-notes#3.10.4
https://docs.github.com/en/[email protected]/admin/release-notes#3.11.1