CVE-2022-23738: 
GitHub Enterprise Server vulnerability analysis and mitigation

An improper cache key vulnerability (CVE-2022-23738) was identified in GitHub Enterprise Server that allowed unauthorized actors to access private repository files through public repositories. The vulnerability was discovered and reported through the GitHub Bug Bounty program, affecting all versions of GitHub Enterprise Server prior to 3.6 (CVE Mitre).

The vulnerability stems from an improper cache key implementation in GitHub Enterprise Server. To exploit this vulnerability, an attacker would need to be already authorized on the GitHub Enterprise Server instance, have the ability to create a public repository, and convince a site administrator to visit a specially crafted URL (CVE Mitre).

The vulnerability allows unauthorized access to private repository files through public repositories, potentially exposing sensitive information and proprietary code stored in private repositories (CVE Mitre).

The vulnerability has been fixed in multiple GitHub Enterprise Server versions: 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. Organizations using affected versions should upgrade to these patched versions to mitigate the vulnerability (CVE Mitre).