Medium severity · published Dec 21, 2023
CVE-2023-6803
Race Condition allows Unauthorized Outside Collaborator
4.0
CVSS
0.2%
EPSS
No
On KEV
Description
A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Server · GitHub
3.8 through 3.8.11; 3.9 through 3.9.6; 3.10 through 3.10.3; 3.11 through 3.11.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6803
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6803
Release Notes
https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
Release Notes
https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
Release Notes
https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
Release Notes
https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
More from Enterprise Server
9.8
CVE-2026-77987
GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
9.8
CVE-2026-8034
Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion
9.8
CVE-2024-6800
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed…
9.8
CVE-2024-4985
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions…
9.8
CVE-2024-0200
Unsafe Reflection in Github Enterprise Server leading to Command Injection