Vulnerability · Published Nov 23, 2022 · Assigned by GitHub_P

CVE-2022-23740Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution

High 8.8

In plain English

A high-severity argument injection in GitHub Enterprise Server from GitHub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.2%top 31.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.

Affected products (as reported)

Vendor	Product	Versions
GitHub	GitHub Enterprise Server	3.7 – before 3.7.1

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1