title: Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists
description: An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.9 and was fixed in versions 3.4.18, 3.5.15, 3.6.11, 3.7.8, and 3.8.1. This vulnerability was reported via the GitHub Bug Bounty program.
problem types: CWE-287 Improper Authentication
affected:
{
defaultStatus: affected
product: Enterprise Server
vendor: GitHub
versions:
changes: [at: 3.4.18, status: unaffected], lessThanOrEqual: 3.4.17, status: affected, version: 3.4.0, versionType: semver
changes: [at: 3.5.15, status: unaffected], lessThanOrEqual: 3.5.14, status: affected, version: 3.5.0, versionType: semver
changes: [at: 3.6.11, status: unaffected], lessThanOrEqual: 3.6.10, status: affected, version: 3.6.0, versionType: semver
changes: [at: 3.7.8, status: unaffected], lessThanOrEqual: 3.7.7, status: affected, version: 3.7.0, versionType: semver
changes: [at: 3.8.1, status: unaffected], lessThan: 3.8.1, status: affected, version: 3.8.0, versionType: semver
status: unaffected, version: 3.9.0
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL