This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitHub Enterprise Server fixes 3 vulnerabilities
GitHub Enterprise Server fixes 3 vulnerabilities with versions 3.16.2, 3.15.6, 3.14.11 and 3.13.14 [1][2][3].
Allows an authenticated remote attacker, through improper neutralization of input in the '$$..$$' math blocks in GitHub Markdown, to carry out an XSS attack [1].
The vulnerability is present in product:
- *:GitHub Enterprise Server; =3.16.1
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
More information:
- CVE-2025-3246 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 4. 2025.
Allows an authenticated remote attacker to carry out an RCE attack, which may lead to privilege escalation and full system compromise [2].
The vulnerability is present in product:
- *:GitHub Enterprise Server; <= 3.17
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:N/R:U/V:C/RE:M/U:Amber
More information:
- CVE-2025-3509 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 4. 2025.
Allows an authenticated remote attacker, through missing authorization, to view the names of private repositories in the security overview within GitHub Advanced Security. The vulnerability manifests only when the "archived:" filter is used [3].
The vulnerability is present in product:
- *:GitHub Enterprise Server prior; <=3.17
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2025-3124 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 17. 4. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 25. 4. 2025.