CVE-2023-6804

Summary

CVE-2023-6804 is a privilege misconfiguration vulnerability affecting all versions of GitHub Enterprise Server from 3.8 to 3.11.1. This issue stems from improper handling of Pull Access Tokens (PATs), which allowed unauthorized users to commit and execute arbitrary workflows. Exploitation required a pre-existing workflow in the target repository. GitHub released patches in versions 3.8.12, 3.9.7, 3.10.4, and 3.11.1 to address this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.