CVE-2022-23737

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237385.7An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private reposito CVE-2022-237399.8An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API re CVE-2022-23744.8The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high p CVE-2022-237408.8CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabl CVE-2022-237417.2An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate t CVE-2022-237427.8Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low pri CVE-2022-237437.8Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, wea CVE-2022-237442.3Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection b CVE-2022-237457.5A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application cra CVE-2022-237467.5The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured fo CVE-2022-237479.8In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed CVE-2022-237487.8mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under