CVE-2025-8447

Katalog CVE

CVSS 3.1 · Low EPSS 0,31%

Kerentanan Authorization Bypass Through User-Controlled Key pada github enterprise server. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.

Rincian

Terbit di NVD

26 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.17 release notes
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.12 release notes
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.8 release notes
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.5 release notes