CVE-2022-46255

An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A check was added within Pages to ensure the working directory is clean before unpacking new content to prevent an arbitrary file overwrite bug. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1
https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1

Configurations

Configuration 1 (hide)

cpe:2.3:a:github:enterprise_server:3.7.0:*:*:*:*:*:*:*

History

21 Nov 2024, 07:30

Type	Values Removed	Values Added
References	~~() https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1 -~~	() https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1 -

07 Nov 2023, 03:55

Type	Values Removed	Values Added
References	{'url': 'https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.1', 'name': 'https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.1', 'tags': ['Release Notes', 'Vendor Advisory'], 'refsource': 'MISC'}	() https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1 -

Information

Published : 2022-12-14 18:15

Updated : 2024-11-21 07:30

NVD link : CVE-2022-46255

Mitre link : CVE-2022-46255

CVE.ORG link : CVE-2022-46255

JSON object : View

Products Affected

github

enterprise_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-46255", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-12-14T18:15:23.193", "references": [{"url": "https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A check was added within Pages to ensure the working directory is clean before unpacking new content to prevent an arbitrary file overwrite bug. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Se identific\u00f3 una limitaci\u00f3n inadecuada de un nombre de ruta a una vulnerabilidad de directorio restringido en GitHub Enterprise Server que permit\u00eda la ejecuci\u00f3n remota de c\u00f3digo. Se agreg\u00f3 una verificaci\u00f3n dentro de Pages para garantizar que el directorio de trabajo est\u00e9 limpio antes de descomprimir contenido nuevo para evitar un error de sobrescritura arbitraria de archivos. Esta vulnerabilidad afect\u00f3 solo a la versi\u00f3n 3.7.0 de GitHub Enterprise Server y se solucion\u00f3 en la versi\u00f3n 3.7.1. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2024-11-21T07:30:17.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:3.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC0AA188-F17E-4FED-98E9-10CAC3E9797E"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}