{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T17:58:40.000","vulnerabilities":[{"cve":{"id":"CVE-2025-8447","sourceIdentifier":"product-cna@github.com","published":"2025-08-26T02:15:36.270","lastModified":"2025-09-03T17:42:50.427","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program."},{"lang":"es","value":"Se identificó una vulnerabilidad de control de acceso indebido en GitHub Enterprise Server que permitía a los usuarios con acceso a cualquier repositorio recuperar código limitado de otro mediante la creación de una comparación entre ellos. Para explotar esta vulnerabilidad, un atacante necesitaba conocer el nombre de un repositorio privado, junto con sus ramas, etiquetas o SHA de commit, para activar la función de comparación y obtener código limitado sin la debida autorización. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.18 y se corrigió en las versiones 3.14.17, 3.15.12, 3.16.8 y 3.17.5. Se informó de esta vulnerabilidad a través del programa de recompensas por errores de GitHub."}],"metrics":{"cvssMetricV40":[{"source":"product-cna@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}]},"weaknesses":[{"source":"product-cna@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionEndExcluding":"3.14.17","matchCriteriaId":"92B484DA-6E4D-4EF5-91A8-CAC1FF941FFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.15.0","versionEndExcluding":"3.15.12","matchCriteriaId":"D4BC30E7-7E02-49F7-836E-C8821E931CF1"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.0","versionEndExcluding":"3.16.8","matchCriteriaId":"25F5CF4D-9502-4ADB-981D-388EF4477066"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17.0","versionEndExcluding":"3.17.5","matchCriteriaId":"9267B319-C1A9-4E15-861E-DE925AD4C23D"}]}]}],"references":[{"url":"https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.17","source":"product-cna@github.com","tags":["Release Notes"]},{"url":"https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.12","source":"product-cna@github.com","tags":["Release Notes"]},{"url":"https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.8","source":"product-cna@github.com","tags":["Release Notes"]},{"url":"https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.5","source":"product-cna@github.com","tags":["Release Notes"]}]}}]}