CVE-2023-46648

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-331

Affected software

Vendor	Product	Versions
GitHub	Enterprise Server	>= 3.8.0, < 3.8.12; >= 3.9.0, < 3.9.7; >= 3.10.0, < 3.10.4; >= 3.11.0, < 3.11.1

References

https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7Release Notes
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7Release Notes

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466497.0A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organizat CVE-2023-46658.8Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira C CVE-2023-466505.4Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a store CVE-2023-466516.5Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configu CVE-2023-466524.3A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enume CVE-2023-466536.5Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting i CVE-2023-466548.1Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup proc CVE-2023-466556.5Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publish CVE-2023-466565.3Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the pro CVE-2023-466575.3Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook CVE-2023-466585.3Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and CVE-2023-466595.4Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scrip