CVE-2023-6804 — Improper Privilege Management allows for arbitrary workflows to be run
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the ta…
Published: 2023-12-21 · CVSS: 6.5 · CVSS 3.1
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7