CVE-2025-23369 Details
Description
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
A vulnerability allowing signature spoofing has been identified in GitHub Enterprise Server. This issue arises from improper verification of cryptographic signatures in SAML responses, which could be exploited by unauthorized internal users to gain access to accounts with administrator privileges. The vulnerability affects all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. Instances not using SAML single sign-on or where the attacker is not an existing user are not impacted.
Users can upgrade to GitHub Enterprise Server versions 3.12.14, 3.13.10, 3.14.7, or 3.15.2. For instructions on upgrading, see the GitHub Enterprise Server release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github enterprise server | < 3.12.14 >= 3.13.0, < 3.13.10 >= 3.14.0, < 3.14.7 >= 3.15.0, < 3.15.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2025 | Initial Analysis | [email protected] |
| Feb 5, 2025 | CVE Modified | [email protected] |
| Jan 21, 2025 | New CVE Received | [email protected] |