CVE-2023-46646

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.7.0 through 3.17.18 GitHub Enterprise Server versions 3.8.0 through 3.8.11 GitHub Enterprise Server versions 3.9.0 through 3.9.6 GitHub Enterprise Server versions 3.10.0 through 3.10.3

Description The issue is related to improper access control in GitHub Enterprise Server, allowing unauthorized users to view private repository names via the "Get a check run" API endpoint. This does not allow unauthorized access to any repository content besides the name.

Recommendations For GitHub Enterprise Server versions 3.7.0 through 3.17.18, update to version 3.17.19 or later. For GitHub Enterprise Server versions 3.8.0 through 3.8.11, update to version 3.8.12 or later. For GitHub Enterprise Server versions 3.9.0 through 3.9.6, update to version 3.9.7 or later. For GitHub Enterprise Server versions 3.10.0 through 3.10.3, update to version 3.10.4 or later. As a temporary workaround, consider restricting access to the "Get a check run" API endpoint until a patch is available.