ghtier — GitHub permissions, tiers and attack paths

← Back to Enterprise plane incidents

EnterpriseFixed 2022

CVE-2022-23732: Management Console path traversal / CSRF bypass

A Management Console path traversal vulnerability bypassed CSRF protections, leading to privilege escalation on the appliance.

Permissions abused

Management Console path traversal bypassing CSRF

Sources

advisoryCVE-2022-23732: Management Console path traversal, CSRF bypass

Frameworks

Part of

Self-hosted GHES is a patching race

Fixed. First seen January 2022. Mapping by ghtier, not yet reviewed. Threat landscape