CVE-2023-23762 Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

Medium 6.5 Published 7 Apr 2023 Updated 10 Feb 2025

Attackers with write access can smuggle commits by exploiting incorrect comparisons, displaying misleading diffs to bypass code review controls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-23762?

CVE-2023-23762 is a medium-severity vulnerability in Github Enterprise Server, published on 7 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff. To do so, an attacker would need write access to the repository and be able to correctly guess the target branch before it’s created by the code maintainer. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.9 and was fixed in versions 3.4.18, 3.5.15, 3.6.11, 3.7.8, and 3.8.1. This vulnerability was reported via the GitHub Bug Bounty program.

Weakness: CWE-697

Which versions are affected by CVE-2023-23762?

It affects 1 product.

Products include Github Enterprise Server.

How do I fix CVE-2023-23762?

No fix has been published for CVE-2023-23762 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-23762 being exploited?

There is no known exploitation of CVE-2023-23762 in the wild and no public exploit code.

All Github Enterprise Server vulnerabilities

Sources

Also known as GHSA-jv37-6f69-j8gw.