CVE-2022-23741

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237427.8Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low pri CVE-2022-237437.8Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, wea CVE-2022-237442.3Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection b CVE-2022-237457.5A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application cra CVE-2022-237467.5The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured fo CVE-2022-237479.8In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed CVE-2022-237487.8mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under CVE-2022-23755.4The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenti CVE-2022-23765.3The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated a CVE-2022-237638.8Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers c CVE-2022-237649.8The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass CVE-2022-237658.8This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS