CVE-2022-46257 (GCVE-0-2022-46257)

Vulnerability from cvelistv5 – Published: 2023-03-07 00:00 – Updated: 2025-03-06 14:52
VLAI?
Title
Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names
Summary
An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
GitHub GitHub Enterprise Server Affected: 3.3 , < 3.3.17 (custom)
Affected: 3.4 , < 3.4.12 (custom)
Affected: 3.5 , < 3.5.9 (custom)
Affected: 3.6 , < 3.6.5 (custom)
Create a notification for this product.
Credits
Anthony Bouvet (Kuromatae)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:31:45.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-46257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T14:52:28.943417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T14:52:44.927Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.12",
              "status": "affected",
              "version": "3.4",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.9",
              "status": "affected",
              "version": "3.5",
              "versionType": "custom"
            },
            {
              "lessThan": "3.6.5",
              "status": "affected",
              "version": "3.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anthony Bouvet (Kuromatae)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-07T00:00:00.000Z",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "url": "https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9"
        },
        {
          "url": "https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2022-46257",
    "datePublished": "2023-03-07T00:00:00.000Z",
    "dateReserved": "2022-11-28T00:00:00.000Z",
    "dateUpdated": "2025-03-06T14:52:44.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-46257",
      "date": "2026-05-07",
      "epss": "0.00192",
      "percentile": "0.40809"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.3.0\", \"versionEndExcluding\": \"3.3.17\", \"matchCriteriaId\": \"706EEA13-73A9-4AA6-8148-C48A68C4CC49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.4.0\", \"versionEndExcluding\": \"3.4.12\", \"matchCriteriaId\": \"0F3D1E90-878E-40C4-BF81-4875470E8E55\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.5.0\", \"versionEndExcluding\": \"3.5.9\", \"matchCriteriaId\": \"84048F59-1F7B-40CF-8B8F-B74FE2F10A96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.6.0\", \"versionEndExcluding\": \"3.6.5\", \"matchCriteriaId\": \"73AE682C-600E-41D5-947D-4F69EEC202C8\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.\"}]",
      "id": "CVE-2022-46257",
      "lastModified": "2024-11-21T07:30:17.870",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}]}",
      "published": "2023-03-07T17:15:12.447",
      "references": "[{\"url\": \"https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "product-cna@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"product-cna@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-668\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-46257\",\"sourceIdentifier\":\"product-cna@github.com\",\"published\":\"2023-03-07T17:15:12.447\",\"lastModified\":\"2024-11-21T07:30:17.870\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndExcluding\":\"3.3.17\",\"matchCriteriaId\":\"706EEA13-73A9-4AA6-8148-C48A68C4CC49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.12\",\"matchCriteriaId\":\"0F3D1E90-878E-40C4-BF81-4875470E8E55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.0\",\"versionEndExcluding\":\"3.5.9\",\"matchCriteriaId\":\"84048F59-1F7B-40CF-8B8F-B74FE2F10A96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndExcluding\":\"3.6.5\",\"matchCriteriaId\":\"73AE682C-600E-41D5-947D-4F69EEC202C8\"}]}]}],\"references\":[{\"url\":\"https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T14:31:45.901Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-46257\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-06T14:52:28.943417Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-06T14:52:35.415Z\"}}], \"cna\": {\"title\": \"Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"Anthony Bouvet (Kuromatae)\"}], \"affected\": [{\"vendor\": \"GitHub\", \"product\": \"GitHub Enterprise Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.3\", \"lessThan\": \"3.3.17\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.4\", \"lessThan\": \"3.4.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.5\", \"lessThan\": \"3.5.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.6\", \"lessThan\": \"3.6.5\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9\"}, {\"url\": \"https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Information Disclosure\"}]}], \"providerMetadata\": {\"orgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"shortName\": \"GitHub_P\", \"dateUpdated\": \"2023-03-07T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-46257\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-06T14:52:44.927Z\", \"dateReserved\": \"2022-11-28T00:00:00.000Z\", \"assignerOrgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"datePublished\": \"2023-03-07T00:00:00.000Z\", \"assignerShortName\": \"GitHub_P\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.