Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVE-2021-22863 (GCVE-0-2021-22863)

Vulnerability from nvd – Published: 2021-03-03 03:25 – Updated: 2024-08-03 18:51

Title

Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests

Summary

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%403.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.24 (custom) Affected: 2.21 , < 2.21.15 (custom) Affected: 2.22 , < 2.22.7 (custom) Affected: 3.0 , < 3.0.1 (custom)

Credits

Teddy Katz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:51:07.572Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.24",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.15",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.22.7",
              "status": "affected",
              "version": "2.22",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Teddy Katz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:23",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2021-22863",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.22",
                            "version_value": "2.22.7"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.0",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Teddy Katz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2021-22863",
    "datePublished": "2021-03-03T03:25:23",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-08-03T18:51:07.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22862 (GCVE-0-2021-22862)

Vulnerability from nvd – Published: 2021-03-03 03:25 – Updated: 2024-08-03 18:51

Title

Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

https://docs.github.com/en/enterprise-server%403.…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 3.0 , < 3.0.1 (custom)

Credits

Teddy Katz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:51:07.479Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "3.0.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Teddy Katz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:22",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2021-22862",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.0",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Teddy Katz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2021-22862",
    "datePublished": "2021-03-03T03:25:22",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-08-03T18:51:07.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22861 (GCVE-0-2021-22861)

Vulnerability from nvd – Published: 2021-03-03 03:25 – Updated: 2024-08-03 18:51

Title

Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%403.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.24 (custom) Affected: 2.21 , < 2.21.15 (custom) Affected: 2.22 , < 2.22.7 (custom) Affected: 3.0 , < 3.0.1 (custom)

Credits

Teddy Katz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:51:07.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.24",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.15",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.22.7",
              "status": "affected",
              "version": "2.22",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Teddy Katz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:21",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2021-22861",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.22",
                            "version_value": "2.22.7"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.0",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Teddy Katz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2021-22861",
    "datePublished": "2021-03-03T03:25:21",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-08-03T18:51:07.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10519 (GCVE-0-2020-10519)

Vulnerability from nvd – Published: 2021-03-03 03:25 – Updated: 2024-08-04 11:06

Title

Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

Summary

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-77 - Command Injection - Generic

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.24 (custom) Affected: 2.21 , < 2.21.15 (custom) Affected: 2.22 , < 2.22.7 (custom)

Credits

yvvdwf

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.24",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.15",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.22.7",
              "status": "affected",
              "version": "2.22",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "yvvdwf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Command Injection - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:21",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10519",
          "STATE": "PUBLIC",
          "TITLE": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.22",
                            "version_value": "2.22.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "yvvdwf"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-77: Command Injection - Generic"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10519",
    "datePublished": "2021-03-03T03:25:21",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10518 (GCVE-0-2020-10518)

Vulnerability from nvd – Published: 2020-08-27 21:55 – Updated: 2024-08-04 11:06

Title

Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

Summary

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-77 - Command Injection - Generic

Assigner

GitHub_P

References

URL

Tags

	https://enterprise.github.com/releases/2.19.21/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.20.15/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.21.6/notes	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.19 , < 2.19.21 (custom) Affected: 2.20 , < 2.20.15 (custom) Affected: 2.21 , < 2.21.6 (custom)

Credits

William Bowling

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.883Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.19.21/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.20.15/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.21.6/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.19.21",
              "status": "affected",
              "version": "2.19",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.15",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "William Bowling"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Command Injection - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-27T21:55:11",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.19.21/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.20.15/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.21.6/notes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10518",
          "STATE": "PUBLIC",
          "TITLE": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.19",
                            "version_value": "2.19.21"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "William Bowling"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-77: Command Injection - Generic"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://enterprise.github.com/releases/2.19.21/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.19.21/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.20.15/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.20.15/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.21.6/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.21.6/notes"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10518",
    "datePublished": "2020-08-27T21:55:11",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10517 (GCVE-0-2020-10517)

Vulnerability from nvd – Published: 2020-08-27 21:55 – Updated: 2024-08-04 11:06

Title

Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://enterprise.github.com/releases/2.19.21/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.20.15/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.21.6/notes	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.21 , < 2.21.6 (custom) Affected: 2.20 , < 2.20.15 (custom) Affected: 2.19 , < 2.19.21 (custom)

Credits

William Bowling

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.19.21/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.20.15/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.21.6/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.15",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.19.21",
              "status": "affected",
              "version": "2.19",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "William Bowling"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-27T21:55:16",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.19.21/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.20.15/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.21.6/notes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10517",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.6"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.19",
                            "version_value": "2.19.21"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "William Bowling"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://enterprise.github.com/releases/2.19.21/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.19.21/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.20.15/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.20.15/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.21.6/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.21.6/notes"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10517",
    "datePublished": "2020-08-27T21:55:16",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10516 (GCVE-0-2020-10516)

Vulnerability from nvd – Published: 2020-06-03 13:31 – Updated: 2024-08-04 11:06

Title

Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member

Summary

An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://enterprise.github.com/releases/2.20.9/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.19.15/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.18.20/notes	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.9 (custom) Affected: 2.19 , < 2.19.15 (custom) Affected: 2.18 , < 2.18.20 (custom)

Credits

Vaibhav Singh

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.20.9/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.19.15/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.18.20/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.9",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.19.15",
              "status": "affected",
              "version": "2.19",
              "versionType": "custom"
            },
            {
              "lessThan": "2.18.20",
              "status": "affected",
              "version": "2.18",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Vaibhav Singh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-03T13:31:24",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.20.9/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.19.15/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.18.20/notes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10516",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.19",
                            "version_value": "2.19.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.18",
                            "version_value": "2.18.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Vaibhav Singh"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://enterprise.github.com/releases/2.20.9/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.20.9/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.19.15/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.19.15/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.18.20/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.18.20/notes"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10516",
    "datePublished": "2020-06-03T13:31:24",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-18365 (GCVE-0-2017-18365)

Vulnerability from nvd – Published: 2019-03-28 05:23 – Updated: 2024-08-05 21:20

Summary

The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	https://www.exablue.de/blog/2017-03-15-github-ent…	x_refsource_MISC
	https://enterprise.github.com/releases/2.8.7/notes	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T21:20:50.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.8.7/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product\u0027s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-28T05:23:18",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.8.7/notes"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-18365",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product\u0027s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html",
              "refsource": "MISC",
              "url": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html"
            },
            {
              "name": "https://enterprise.github.com/releases/2.8.7/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.8.7/notes"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-18365",
    "datePublished": "2019-03-28T05:23:18",
    "dateReserved": "2019-03-28T00:00:00",
    "dateUpdated": "2024-08-05T21:20:50.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2055 (GCVE-0-2012-2055)

Vulnerability from nvd – Published: 2012-04-04 10:00 – Updated: 2024-08-06 19:17

Summary

GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://homakov.blogspot.com/2012/03/how-to.html	x_refsource_MISC
	http://lwn.net/Articles/488702/	x_refsource_MISC
	https://github.com/blog/1068-public-key-security-…	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.693Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://homakov.blogspot.com/2012/03/how-to.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lwn.net/Articles/488702/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation"
          },
          {
            "name": "github-hash-security-bypass(74812)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74812"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model\u0027s attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a \"mass assignment\" vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-19T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://homakov.blogspot.com/2012/03/how-to.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lwn.net/Articles/488702/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation"
        },
        {
          "name": "github-hash-security-bypass(74812)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74812"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2055",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model\u0027s attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a \"mass assignment\" vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://homakov.blogspot.com/2012/03/how-to.html",
              "refsource": "MISC",
              "url": "http://homakov.blogspot.com/2012/03/how-to.html"
            },
            {
              "name": "http://lwn.net/Articles/488702/",
              "refsource": "MISC",
              "url": "http://lwn.net/Articles/488702/"
            },
            {
              "name": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation",
              "refsource": "CONFIRM",
              "url": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation"
            },
            {
              "name": "github-hash-security-bypass(74812)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74812"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-2055",
    "datePublished": "2012-04-04T10:00:00",
    "dateReserved": "2012-04-04T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22863 (GCVE-0-2021-22863)

Vulnerability from cvelistv5 – Published: 2021-03-03 03:25 – Updated: 2024-08-03 18:51

Title

Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests

Summary

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%403.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.24 (custom) Affected: 2.21 , < 2.21.15 (custom) Affected: 2.22 , < 2.22.7 (custom) Affected: 3.0 , < 3.0.1 (custom)

Credits

Teddy Katz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:51:07.572Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.24",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.15",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.22.7",
              "status": "affected",
              "version": "2.22",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Teddy Katz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:23",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2021-22863",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.22",
                            "version_value": "2.22.7"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.0",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Teddy Katz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2021-22863",
    "datePublished": "2021-03-03T03:25:23",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-08-03T18:51:07.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22862 (GCVE-0-2021-22862)

Vulnerability from cvelistv5 – Published: 2021-03-03 03:25 – Updated: 2024-08-03 18:51

Title

Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

https://docs.github.com/en/enterprise-server%403.…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 3.0 , < 3.0.1 (custom)

Credits

Teddy Katz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:51:07.479Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "3.0.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Teddy Katz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:22",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2021-22862",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.0",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Teddy Katz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2021-22862",
    "datePublished": "2021-03-03T03:25:22",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-08-03T18:51:07.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22861 (GCVE-0-2021-22861)

Vulnerability from cvelistv5 – Published: 2021-03-03 03:25 – Updated: 2024-08-03 18:51

Title

Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%403.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.24 (custom) Affected: 2.21 , < 2.21.15 (custom) Affected: 2.22 , < 2.22.7 (custom) Affected: 3.0 , < 3.0.1 (custom)

Credits

Teddy Katz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:51:07.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.24",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.15",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.22.7",
              "status": "affected",
              "version": "2.22",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Teddy Katz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:21",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2021-22861",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.22",
                            "version_value": "2.22.7"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.0",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Teddy Katz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2021-22861",
    "datePublished": "2021-03-03T03:25:21",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-08-03T18:51:07.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10519 (GCVE-0-2020-10519)

Vulnerability from cvelistv5 – Published: 2021-03-03 03:25 – Updated: 2024-08-04 11:06

Title

Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

Summary

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-77 - Command Injection - Generic

Assigner

GitHub_P

References

URL

Tags

	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC
	https://docs.github.com/en/enterprise-server%402.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.24 (custom) Affected: 2.21 , < 2.21.15 (custom) Affected: 2.22 , < 2.22.7 (custom)

Credits

yvvdwf

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.24",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.15",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.22.7",
              "status": "affected",
              "version": "2.22",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "yvvdwf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Command Injection - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-03T03:25:21",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10519",
          "STATE": "PUBLIC",
          "TITLE": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.22",
                            "version_value": "2.22.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "yvvdwf"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-77: Command Injection - Generic"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
            },
            {
              "name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
              "refsource": "MISC",
              "url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10519",
    "datePublished": "2021-03-03T03:25:21",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10517 (GCVE-0-2020-10517)

Vulnerability from cvelistv5 – Published: 2020-08-27 21:55 – Updated: 2024-08-04 11:06

Title

Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://enterprise.github.com/releases/2.19.21/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.20.15/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.21.6/notes	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.21 , < 2.21.6 (custom) Affected: 2.20 , < 2.20.15 (custom) Affected: 2.19 , < 2.19.21 (custom)

Credits

William Bowling

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.19.21/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.20.15/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.21.6/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.15",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.19.21",
              "status": "affected",
              "version": "2.19",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "William Bowling"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-27T21:55:16",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.19.21/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.20.15/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.21.6/notes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10517",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.6"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.19",
                            "version_value": "2.19.21"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "William Bowling"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://enterprise.github.com/releases/2.19.21/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.19.21/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.20.15/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.20.15/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.21.6/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.21.6/notes"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10517",
    "datePublished": "2020-08-27T21:55:16",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10518 (GCVE-0-2020-10518)

Vulnerability from cvelistv5 – Published: 2020-08-27 21:55 – Updated: 2024-08-04 11:06

Title

Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

Summary

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-77 - Command Injection - Generic

Assigner

GitHub_P

References

URL

Tags

	https://enterprise.github.com/releases/2.19.21/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.20.15/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.21.6/notes	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.19 , < 2.19.21 (custom) Affected: 2.20 , < 2.20.15 (custom) Affected: 2.21 , < 2.21.6 (custom)

Credits

William Bowling

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.883Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.19.21/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.20.15/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.21.6/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.19.21",
              "status": "affected",
              "version": "2.19",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.15",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "William Bowling"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Command Injection - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-27T21:55:11",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.19.21/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.20.15/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.21.6/notes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10518",
          "STATE": "PUBLIC",
          "TITLE": "Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.19",
                            "version_value": "2.19.21"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.21",
                            "version_value": "2.21.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "William Bowling"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-77: Command Injection - Generic"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://enterprise.github.com/releases/2.19.21/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.19.21/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.20.15/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.20.15/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.21.6/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.21.6/notes"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10518",
    "datePublished": "2020-08-27T21:55:11",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10516 (GCVE-0-2020-10516)

Vulnerability from cvelistv5 – Published: 2020-06-03 13:31 – Updated: 2024-08-04 11:06

Title

Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member

Summary

An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.

Severity ?

No CVSS data available.

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_P

References

URL

Tags

	https://enterprise.github.com/releases/2.20.9/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.19.15/notes	x_refsource_MISC
	https://enterprise.github.com/releases/2.18.20/notes	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	GitHub	GitHub Enterprise Server	Affected: 2.20 , < 2.20.9 (custom) Affected: 2.19 , < 2.19.15 (custom) Affected: 2.18 , < 2.18.20 (custom)

Credits

Vaibhav Singh

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:09.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.20.9/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.19.15/notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.18.20/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitHub Enterprise Server",
          "vendor": "GitHub",
          "versions": [
            {
              "lessThan": "2.20.9",
              "status": "affected",
              "version": "2.20",
              "versionType": "custom"
            },
            {
              "lessThan": "2.19.15",
              "status": "affected",
              "version": "2.19",
              "versionType": "custom"
            },
            {
              "lessThan": "2.18.20",
              "status": "affected",
              "version": "2.18",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Vaibhav Singh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-03T13:31:24",
        "orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
        "shortName": "GitHub_P"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.20.9/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.19.15/notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.18.20/notes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-cna@github.com",
          "ID": "CVE-2020-10516",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GitHub Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20",
                            "version_value": "2.20.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.19",
                            "version_value": "2.19.15"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.18",
                            "version_value": "2.18.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GitHub"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Vaibhav Singh"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://enterprise.github.com/releases/2.20.9/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.20.9/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.19.15/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.19.15/notes"
            },
            {
              "name": "https://enterprise.github.com/releases/2.18.20/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.18.20/notes"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
    "assignerShortName": "GitHub_P",
    "cveId": "CVE-2020-10516",
    "datePublished": "2020-06-03T13:31:24",
    "dateReserved": "2020-03-12T00:00:00",
    "dateUpdated": "2024-08-04T11:06:09.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-18365 (GCVE-0-2017-18365)

Vulnerability from cvelistv5 – Published: 2019-03-28 05:23 – Updated: 2024-08-05 21:20

Summary

The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	https://www.exablue.de/blog/2017-03-15-github-ent…	x_refsource_MISC
	https://enterprise.github.com/releases/2.8.7/notes	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T21:20:50.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://enterprise.github.com/releases/2.8.7/notes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product\u0027s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-28T05:23:18",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://enterprise.github.com/releases/2.8.7/notes"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-18365",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product\u0027s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html",
              "refsource": "MISC",
              "url": "https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html"
            },
            {
              "name": "https://enterprise.github.com/releases/2.8.7/notes",
              "refsource": "MISC",
              "url": "https://enterprise.github.com/releases/2.8.7/notes"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-18365",
    "datePublished": "2019-03-28T05:23:18",
    "dateReserved": "2019-03-28T00:00:00",
    "dateUpdated": "2024-08-05T21:20:50.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2055 (GCVE-0-2012-2055)

Vulnerability from cvelistv5 – Published: 2012-04-04 10:00 – Updated: 2024-08-06 19:17

Summary

GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://homakov.blogspot.com/2012/03/how-to.html	x_refsource_MISC
	http://lwn.net/Articles/488702/	x_refsource_MISC
	https://github.com/blog/1068-public-key-security-…	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.693Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://homakov.blogspot.com/2012/03/how-to.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lwn.net/Articles/488702/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation"
          },
          {
            "name": "github-hash-security-bypass(74812)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74812"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model\u0027s attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a \"mass assignment\" vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-19T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://homakov.blogspot.com/2012/03/how-to.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lwn.net/Articles/488702/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation"
        },
        {
          "name": "github-hash-security-bypass(74812)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74812"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2055",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model\u0027s attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a \"mass assignment\" vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://homakov.blogspot.com/2012/03/how-to.html",
              "refsource": "MISC",
              "url": "http://homakov.blogspot.com/2012/03/how-to.html"
            },
            {
              "name": "http://lwn.net/Articles/488702/",
              "refsource": "MISC",
              "url": "http://lwn.net/Articles/488702/"
            },
            {
              "name": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation",
              "refsource": "CONFIRM",
              "url": "https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation"
            },
            {
              "name": "github-hash-security-bypass(74812)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74812"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-2055",
    "datePublished": "2012-04-04T10:00:00",
    "dateReserved": "2012-04-04T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Search criteria

18 vulnerabilities found for github by github

CVE-2021-22863 (GCVE-0-2021-22863)

CVE-2021-22862 (GCVE-0-2021-22862)

CVE-2021-22861 (GCVE-0-2021-22861)

CVE-2020-10519 (GCVE-0-2020-10519)

CVE-2020-10518 (GCVE-0-2020-10518)

CVE-2020-10517 (GCVE-0-2020-10517)

CVE-2020-10516 (GCVE-0-2020-10516)

CVE-2017-18365 (GCVE-0-2017-18365)

CVE-2012-2055 (GCVE-0-2012-2055)

CVE-2021-22863 (GCVE-0-2021-22863)

CVE-2021-22862 (GCVE-0-2021-22862)

CVE-2021-22861 (GCVE-0-2021-22861)

CVE-2020-10519 (GCVE-0-2020-10519)

CVE-2020-10517 (GCVE-0-2020-10517)

CVE-2020-10518 (GCVE-0-2020-10518)

CVE-2020-10516 (GCVE-0-2020-10516)

CVE-2017-18365 (GCVE-0-2017-18365)

CVE-2012-2055 (GCVE-0-2012-2055)