onyx --cves cve-2023-22381
CVE-2023-22381
- score
- <0.1
- cvss
- 4.1
- epss
- 0.8%
- published
- 2023-03-02
- kev added
- —
- first seen
GitHub Enterprise Server < 3.8.0 contains a code injection caused by setting arbitrary environment variables from a single environment variable in GitHub Actions on Windows runners, letting attackers with permission control environment variables, exploit requires existing permission to control environment variables.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.5
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.15
- https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.12
- https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.8