CVE-2022-23734

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237376.5An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to cre CVE-2022-237385.7An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private reposito CVE-2022-237399.8An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API re CVE-2022-23744.8The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high p CVE-2022-237408.8CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabl CVE-2022-237417.2An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate t CVE-2022-237427.8Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low pri CVE-2022-237437.8Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, wea CVE-2022-237442.3Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection b CVE-2022-237457.5A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application cra CVE-2022-237467.5The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured fo CVE-2022-237479.8In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed