CVE-2025-8447
published 2025-08-26CVE-2025-8447: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code…
PriorityP414low3.1CVSS 3.1
AVNACHPRLUINSUCLINAN
EPSS
0.28%
20.0th percentile
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | enterprise_server | < 3.14.17 | 3.14.17 |
| github | enterprise_server | 3.14 – 3.14.16 | — |
| github | enterprise_server | 3.15 – 3.15.11 | — |
| github | enterprise_server | >= 3.15.0 < 3.15.12 | 3.15.12 |
| github | enterprise_server | 3.16 – 3.16.7 | — |
| github | enterprise_server | >= 3.16.0 < 3.16.8 | 3.16.8 |
| github | enterprise_server | 3.17 – 3.17.4 | — |
| github | enterprise_server | >= 3.17.0 < 3.17.5 | 3.17.5 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.07.0HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
HackerOne
Arbitrary Read of Another Users private repository without Authorization
hackerone·2025-09-23·CVSS 3.1
[LOW] Arbitrary Read of Another Users private repository without Authorization
Arbitrary Read of Another Users private repository without Authorization
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5.
[CVE-2025-8447](https://www.cve.org/cverecord?id=CVE-2025-8447)
Bugzilla
CVE-2024-8447 narayana: deadlock via multiple join requests sent to LRA Coordinator
bugzilla·2025-01-01·CVSS 5.9
CVE-2024-8447 [MEDIUM] CVE-2024-8447 narayana: deadlock via multiple join requests sent to LRA Coordinator
CVE-2024-8447 narayana: deadlock via multiple join requests sent to LRA Coordinator
Summary: The server crashes when a new Saga Join request is received within 2 seconds of the LRA Coordinator starting to cancel and the status is still "Canceling."
Description:
When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may hang indefinitely or crash.
References:
https://github.com/jbosstm/narayana/pull/2293
https://issues.redhat.com/browse/JBTM-3911
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Via RHSA-2025:3357 https://access.redhat.com/e
2025-08-26
Published