CVE-2023-22380

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.6. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-223818.8A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single CVE-2023-223828.2Weak configuration in Automotive while VM is processing a listener request from TEE.CVE-2023-223837.8Memory Corruption in camera while installing a fd for a particular DMA buffer.CVE-2023-223847.8Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).CVE-2023-223859.8Memory Corruption in Data Modem while making a MO call or MT VOLTE call.CVE-2023-223867.8Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.CVE-2023-223877.8Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.CVE-2023-223889.8Memory Corruption in Multi-mode Call Processor while processing bit mask API.CVE-2023-223896.5Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via CVE-2023-22396.5Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-223906.5Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to p CVE-2023-223917.5A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticate