CVE-2022-23734 Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution

High 8.8 Published 19 Oct 2022 Updated 9 May 2025

An attacker can achieve remote code execution on the SVNBridge by exploiting a deserialization vulnerability via SSRF in GitHub Enterprise Server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23734?

CVE-2022-23734 is a high-severity unsafe deserialization vulnerability in Github Enterprise Server, published on 19 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program.

Weakness: CWE-502

Which versions are affected by CVE-2022-23734?

It affects 1 product.

Products include Github Enterprise Server.

How do I fix CVE-2022-23734?

No fix has been published for CVE-2022-23734 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-23734 being exploited?

There is no known exploitation of CVE-2022-23734 in the wild and no public exploit code.

All Github Enterprise Server vulnerabilities

Sources

Also known as GHSA-rcm9-3jwh-7pxx.