CVE-2025-11578

{"id": "CVE-2025-11578", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11578", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T17:33:22.593181Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-cna@github.com", "affectedData": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.14.20", "status": "unaffected"}], "version": "3.14", "versionType": "semver", "lessThanOrEqual": "3.14.19"}, {"status": "affected", "changes": [{"at": "3.15.15", "status": "unaffected"}], "version": "3.15", "versionType": "semver", "lessThanOrEqual": "3.15.14"}, {"status": "affected", "changes": [{"at": "3.16.11", "status": "unaffected"}], "version": "3.16", "versionType": "semver", "lessThanOrEqual": "3.16.10"}, {"status": "affected", "changes": [{"at": "3.17.8", "status": "unaffected"}], "version": "3.17", "versionType": "semver", "lessThanOrEqual": "3.17.7"}, {"status": "affected", "changes": [{"at": "3.18.2", "status": "unaffected"}], "version": "3.18", "versionType": "semver", "lessThanOrEqual": "3.18.1"}], "defaultStatus": "affected"}]}], "published": "2025-11-10T23:15:41.193", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.20", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.15", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.11", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.8", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.2", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user\u2019s authorized keys\u2014thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios fue identificada en GitHub Enterprise Server que permit\u00eda a un administrador de Enterprise autenticado obtener acceso SSH de root al dispositivo explotando un escape de symlink en entornos de hooks de pre-recepci\u00f3n. Al crear un repositorio y entorno maliciosos, un atacante pod\u00eda reemplazar binarios del sistema durante la limpieza del hook y ejecutar una carga \u00fatil que a\u00f1ade su propia clave SSH a las claves autorizadas del usuario root, otorg\u00e1ndose as\u00ed acceso SSH de root al servidor. Para explotar esta vulnerabilidad, el atacante necesitaba tener privilegios de administrador de Enterprise. Esta vulnerabilidad afectaba a todas las versiones de GitHub Enterprise Server anteriores a la 3.19, y fue corregida en las versiones 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EB11CA-6023-4B6E-824F-BC1E3B38BBC8", "versionEndExcluding": "3.14.20", "versionStartIncluding": "3.14.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F3CBE73-32C5-4F1A-A660-3016FA77E633", "versionEndExcluding": "3.15.15", "versionStartIncluding": "3.15.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "754773B0-BDEC-497C-91A7-F542A74C4414", "versionEndExcluding": "3.16.11", "versionStartIncluding": "3.16.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C3E38F9-7310-4901-90A8-C0BEAFA8A092", "versionEndExcluding": "3.17.8", "versionStartIncluding": "3.17.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9751597D-AD87-4C92-83EC-87D2474410C5", "versionEndExcluding": "3.18.2", "versionStartIncluding": "3.18.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}