CVE-2025-8447

Published Aug 26, 2025

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-8447 is an improper access control vulnerability discovered in GitHub Enterprise Server. This flaw allowed users who had access to any repository to retrieve limited code content from other repositories. The mechanism for this unauthorized access involved creating a diff between repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository, along with its branches, tags, or commit SHAs. This information would then be used to trigger the compare/diff functionality, enabling the retrieval of limited code without proper authorization. The vulnerability impacted all versions of GitHub Enterprise Server prior to 3.18 and was addressed in versions 3.14.17, 3.15.12, 3.16.8, and 3.17.5.

Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
Source: product-cna@github.com
NVD status: Analyzed
Products: enterprise_server

Risk scores

CVSS 4.0

Type: Secondary
Base score: 7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 3.1
Impact score: 1.4
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: LOW

Weaknesses

product-cna@github.com: CWE-639

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "92B484DA-6E4D-4EF5-91A8-CAC1FF941FFF",
            "versionEndExcluding": "3.14.17",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D4BC30E7-7E02-49F7-836E-C8821E931CF1",
            "versionEndExcluding": "3.15.12",
            "versionStartIncluding": "3.15.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "25F5CF4D-9502-4ADB-981D-388EF4477066",
            "versionEndExcluding": "3.16.8",
            "versionStartIncluding": "3.16.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9267B319-C1A9-4E15-861E-DE925AD4C23D",
            "versionEndExcluding": "3.17.5",
            "versionStartIncluding": "3.17.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.