CVE-2022-23741

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
GitHubGitHub Enterprise Server>= 3.3, < 3.3.17; >= 3.4, < 3.4.12; >= 3.5, < 3.5.9; >= 3.6, < 3.6.5

References

Timeline

Published
Dec 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-237427.8Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low priCVE-2022-237437.8Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weaCVE-2022-237442.3Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bCVE-2022-237457.5A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application craCVE-2022-237467.5The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured foCVE-2022-237479.8In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed CVE-2022-237487.8mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under CVE-2022-23755.4The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthentiCVE-2022-23765.3The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated aCVE-2022-237638.8Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers cCVE-2022-237649.8The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass CVE-2022-237658.8This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS