CVE-2022-46256

CVSS V2 None CVSS V3 None
Description
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5 and 3.7.2. This vulnerability was reported via the GitHub Bug Bounty program.
Overview
  • CVE ID
  • CVE-2022-46256
  • Assigner
  • product-cna@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-12-14T18:15:23
  • Last Modified Date
  • 2022-12-16T21:17:04
Weakness Enumerations
CWE URL
CWE-22 http://cwe.mitre.org/data/definitions/22.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* 1 OR 3.3.17
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* 1 OR 3.4.0 3.4.12
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* 1 OR 3.5.0 3.5.9
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* 1 OR 3.6.0 3.6.5
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* 1 OR 3.7.0 3.7.2
References
Reference URL Reference Tags
https://docs.github.com/en/enterprise-server@3.3/admin/release-notes#3.3.17
https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.12
https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.9
https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.5
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.2
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-46256
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46256
History
Created Old Value New Value Data Type Notes
2022-12-14 18:15:41 Added to TrackCVE
2022-12-14 19:16:38 2022-12-14T18:15:23.553 2022-12-14T18:15:23 CVE Published Date updated
2022-12-14 19:16:38 2022-12-14T19:14:37 CVE Modified Date updated
2022-12-14 19:16:38 Received Awaiting Analysis Vulnerability Status updated
2022-12-18 09:30:10 2022-12-16T21:17:04 CVE Modified Date updated
2022-12-18 09:30:10 Awaiting Analysis Analyzed Vulnerability Status updated
2022-12-18 09:30:10 CWE-22 Weakness Enumeration new
2022-12-18 09:30:14 CPE Information updated