CVE-2022-23732: 
GitHub Enterprise Server vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2022-23732) was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. The vulnerability was discovered and reported through the GitHub Bug Bounty program, with the CVE being created on January 19, 2022. This security issue affected all versions of GitHub Enterprise Server prior to 3.5 (CVE Mitre).

The vulnerability is classified as a path traversal issue (CWE-22/CWE-23) that specifically impacts the CSRF protection mechanisms in the GitHub Enterprise Server management console (NVD Report).

This vulnerability could potentially lead to privilege escalation in GitHub Enterprise Server installations. The impact is limited by the requirement that an attacker would need to target a user that was actively logged into the management console (CVE Mitre).

The exploitation of this vulnerability requires an attacker to target users who are actively logged into the GitHub Enterprise Server management console. The vulnerability was discovered through the GitHub Bug Bounty program, suggesting it was identified under controlled conditions (CVE Mitre).

The vulnerability has been addressed in multiple GitHub Enterprise Server versions. Fixed versions include 3.1.19, 3.2.11, 3.3.6, and 3.4.1. Organizations running affected versions should upgrade to these patched releases or newer versions (CVE Mitre).