CVE-2025-3124
Published: Apr 17, 2025
Modified: Apr 18, 2025
Description
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only using the `archived:` filter and all other access controls were functioning normally. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.17 and was fixed in versions 3.13.14, 3.14.11, 3.15.6, and 3.16.2.
| Vendor | Product | Versions |
|---|---|---|
GitHub | Enterprise Server | affected 3.13.0 - <= 3.13.13affected 3.14.0 - <= 3.14.10affected 3.15.0 - <= 3.15.5affected 3.16.0 - <= 3.16.1unaffected 3.17.0 |
Weaknesses (CWE)
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now