CVE-2021-22862
Published Mar 3, 2021
Last updated a year ago
Overview
- Description
- An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.
- Source
- product-cna@github.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 4
- Impact score
- 2.9
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
- product-cna@github.com
- CWE-285
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:github:github:3.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61ABB5BF-C578-403B-8EF9-A28274F486FF"
},
{
"criteria": "cpe:2.3:a:github:github:3.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "634A0A6C-0F17-4DE2-B2D1-C3B0C5C8EDD6"
},
{
"criteria": "cpe:2.3:a:github:github:3.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FA74C51-5AB4-4B23-B24B-5629736B17E1"
}
],
"operator": "OR"
}
]
}
]