Aller au contenu
Se connecter
Non notée

CVE-2021-22865 An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated…

Description

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read private repository metadata via the REST API without having been granted the appropriate permissions. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. The private repository metadata returned would be limited to repositories owned by the user the token identifies. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.4 and was fixed in versions 3.0.4, 2.22.10, 2.21.18. This vulnerability was reported via the GitHub Bug Bounty program.

Produits et versions touchés

Produit Versions touchées Corrigé en
GitHub Enterprise Server 3.0 3.0 → < 3.0.4 3.0.4
GitHub Enterprise Server 2.22 2.22 → < 2.22.10 2.22.10
GitHub Enterprise Server 2.21 2.21 → < 2.21.18 2.21.18

Autres CVE de GitHub Enterprise Server

Les 46 CVE de GitHub Enterprise Server →
CVE-2025-6600 An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an… 6.3 Moyenne CVE-2025-3246 An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site… 8.6 Élevée CVE-2024-9539 An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL… 5.7 Moyenne CVE-2024-8263 An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped… 6.2 Moyenne
Suivre cette CVE