5.3
CVE-2025-6981
- EPSS 0.18%
- Veröffentlicht 15.07.2025 20:44:30
- Zuletzt bearbeitet 27.08.2025 14:41:04
- Quelle product-cna@github.com
- CVE-Watchlists
- Unerledigt
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access
An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15, 3.15.10, 3.16.6 and 3.17.3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Github ≫ Enterprise Server Version < 3.14.5
Github ≫ Enterprise Server Version >= 3.15.0 < 3.15.10
Github ≫ Enterprise Server Version >= 3.16.0 < 3.16.6
Github ≫ Enterprise Server Version >= 3.17.0 < 3.17.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.18% | 0.394 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| product-cna@github.com | 5.3 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.