Riskcovery

CVE-2023-6803

Race Condition allows Unauthorized Outside Collaborator

State
Published
Severity
5.8 Medium
Published
Dec 21, 2023
Updated
Aug 2, 2024
Reserved
Dec 13, 2023

Read the record on cve.org

Description

A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.

Scores

CVSSScoreVectorSource
3.15.8 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:LGitHub_P

Weaknesses

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

ProductVersions
Enterprise ServerGitHub
  • 3.8 through 3.8.11Affectedfrom 3.8.12Not affected
  • 3.9 through 3.9.6Affectedfrom 3.9.7Not affected
  • 3.10 through 3.10.3Affectedfrom 3.10.4Not affected
  • 3.11 through 3.11.0Affectedfrom 3.11.1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.