description: A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
problem types: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
affected:
{
defaultStatus: affected
product: Enterprise Server
vendor: GitHub
versions:
changes: [at: 3.8.12, status: unaffected], lessThanOrEqual: 3.8.11, status: affected, version: 3.8, versionType: semver
changes: [at: 3.9.7, status: unaffected], lessThanOrEqual: 3.9.6, status: affected, version: 3.9, versionType: semver
changes: [at: 3.10.4, status: unaffected], lessThanOrEqual: 3.10.3, status: affected, version: 3.10, versionType: semver
changes: [at: 3.11.1, status: unaffected], lessThanOrEqual: 3.11.0, status: affected, version: 3.11, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL