CVE-2025-23369
CVSS v3
8.8
HIGH
EPSS Score
10.0 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
Technical details
- Published
- 2025-01-21
Frequently asked questions
What is CVE-2025-23369?
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
Is CVE-2025-23369 actively exploited?
Active exploitation of CVE-2025-23369 has not been confirmed. The EPSS score is 10.0%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2025-23369?
CVE-2025-23369 has a CVSS v3 base score of 8.8 (HIGH severity).
Is CVE-2025-23369 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2025 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).