CVE-2023-23766

Summary

CVE-2023-23766 is an incorrect comparison vulnerability discovered in GitHub Enterprise Server. It allows for commit smuggling by displaying a deceptive diff in a re-opened Pull Request. An attacker must have write access to the repository to exploit this vulnerability. All versions of GitHub Enterprise Server were impacted, but it was patched in versions 3.6.17, 3.7.15, 3.8.8, 3.9.3, and 3.10.1. This vulnerability was reported to GitHub through their Bug Bounty program.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.