{"metadata": {"vulnerability": "cve-2021-22862", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2021-01-06T00:00:00Z", "date_only": false, "value": "2021-01-06T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2021-22862", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-03-03T03:25:22Z", "date_only": false, "value": "2021-03-03T03:25:22.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2021-22862", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-03-03T03:25:22Z", "date_only": false, "value": "2021-03-03T03:25:22.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_P", "record": "cve-2021-22862", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-03-03T04:15:00Z", "date_only": false, "value": "2021-03-03T04:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2XWJ-G27R-P9CR", "record": "GHSA-2XWJ-G27R-P9CR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-03-03T04:15:00Z", "date_only": false, "value": "2021-03-03T04:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-22862", "record": "GSD-2021-22862", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2021-03-03T04:15:13.163Z", "date_only": false, "value": "2021-03-03T04:15:13.163", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22862", "record": "FKIE_CVE-2021-22862", "field": "published"}, {"timestamp": "2021-03-23T19:28:35Z", "date_only": false, "value": "2021-03-23T19:28:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/4501", "record": "CVE-2021-22862", "field": "creation_timestamp", "uuid": "49aa46ef-69b9-48f9-8c4a-e138d7f43542", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 GitHub awards bug bounty hunter $25,000 for Actions secrets theft report.\n\nTracked as\u00a0CVE-2021-22862, the security flaw is described as an improper access control vulnerability that \u201callowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork\u201d.\n\nhttps://blog.teddykatz.com/2021/03/17/github-actions-write-access.html\n\nhttps://portswigger.net/daily-swig/github-awards-bug-bounty-hunter-25-000-for-actions-secrets-theft-report", "url": "https://t.me/cKure/4501"}, {"timestamp": "2022-05-24T17:43:33Z", "date_only": false, "value": "2022-05-24T17:43:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2XWJ-G27R-P9CR", "record": "GHSA-2XWJ-G27R-P9CR", "field": "published"}, {"timestamp": "2022-07-04T20:59:21Z", "date_only": false, "value": "2022-07-04T20:59:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/2976", "record": "CVE-2021-22862", "field": "creation_timestamp", "uuid": "79916192-2b47-4d5e-8354-227a1e7d8de3", "content": "#exploit\n1. Stealing arbitrary GitHub Actions secrets\nhttps://blog.teddykatz.com/2021/03/17/github-actions-write-access.html\n]-> PoC GitHub Actions workflow exploit (CVE-2021-22862):\nhttps://gist.github.com/not-an-aardvark/357547edf338f8fa9920bbcd286e3a7b\n\n2. CVE-2021-3409:\nQEMU <5.2.50 Heap Overflow in SDHCI Component\nhttps://starlabs.sg/advisories/21-3409", "url": "https://t.me/CyberSecurityTechnologies/2976"}, {"timestamp": "2022-10-25T14:03:00Z", "date_only": false, "value": "2022-10-25T14:03Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-22862", "record": "GSD-2021-22862", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-10-25T19:00:35Z", "date_only": false, "value": "2022-10-25T19:00:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2XWJ-G27R-P9CR", "record": "GHSA-2XWJ-G27R-P9CR", "field": "modified"}, {"timestamp": "2023-12-13T01:23:24.719Z", "date_only": false, "value": "2023-12-13T01:23:24.719562Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-22862", "record": "GSD-2021-22862", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T18:51:07.479Z", "date_only": false, "value": "2024-08-03T18:51:07.479Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2021-22862", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-03T18:51:07.479Z", "date_only": false, "value": "2024-08-03T18:51:07.479Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2021-22862", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T03:37:54.070Z", "date_only": false, "value": "2026-06-17T03:37:54.070", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22862", "record": "FKIE_CVE-2021-22862", "field": "lastModified"}, {"timestamp": "2026-09-01T17:00:57.338Z", "date_only": false, "value": "2026-09-01T17:00:57.338014Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/2688", "record": "CVE-2021-22862", "field": "creation_timestamp", "uuid": "35731002-affc-4b02-a63d-0d39aa6e2d80", "url": "https://t.me/cissp/2688"}, {"timestamp": "2026-09-11T14:00:05.574Z", "date_only": false, "value": "2026-09-11T14:00:05.574803Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/2688", "record": "CVE-2021-22862", "field": "creation_timestamp", "uuid": "195fcd5a-d5f0-4d4c-953b-b40bedadc9c5", "url": "https://t.me/cissp/2688"}]}