CVE-2025-3124
MEDIUM EPSS 32.6%
Published Apr 17, 20251y ago · Modified Jun 17, 20261w ago
5.3 CVSS 4.0
Published Apr 17, 2025 1y ago
Last Modified Jun 17, 2026 1w ago
Description
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only using the `archived:` filter and all other access controls were functioning normally. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.17 and was fixed in versions 3.13.14, 3.14.11, 3.15.6, and 3.16.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
32.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-862 Missing Authorization Authorization
Affected Products 4
References 4
- docs.github.com https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.14
- docs.github.com https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.11
- docs.github.com https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.6
- docs.github.com https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.