cve-2021-22861
Vulnerability from cvelistv5
Published
2021-03-03 03:25
Modified
2024-08-03 18:51
Severity ?
EPSS score ?
Summary
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | GitHub | GitHub Enterprise Server |
Version: 2.20 < 2.20.24 Version: 2.21 < 2.21.15 Version: 2.22 < 2.22.7 Version: 3.0 < 3.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.561Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GitHub Enterprise Server",
"vendor": "GitHub",
"versions": [
{
"lessThan": "2.20.24",
"status": "affected",
"version": "2.20",
"versionType": "custom"
},
{
"lessThan": "2.21.15",
"status": "affected",
"version": "2.21",
"versionType": "custom"
},
{
"lessThan": "2.22.7",
"status": "affected",
"version": "2.22",
"versionType": "custom"
},
{
"lessThan": "3.0.1",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Teddy Katz"
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-03T03:25:21",
"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
"shortName": "GitHub_P"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-cna@github.com",
"ID": "CVE-2021-22861",
"STATE": "PUBLIC",
"TITLE": "Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GitHub Enterprise Server",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.20",
"version_value": "2.20.24"
},
{
"version_affected": "\u003c",
"version_name": "2.21",
"version_value": "2.21.15"
},
{
"version_affected": "\u003c",
"version_name": "2.22",
"version_value": "2.22.7"
},
{
"version_affected": "\u003c",
"version_name": "3.0",
"version_value": "3.0.1"
}
]
}
}
]
},
"vendor_name": "GitHub"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Teddy Katz"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-285 Improper Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24",
"refsource": "MISC",
"url": "https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24"
},
{
"name": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15",
"refsource": "MISC",
"url": "https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15"
},
{
"name": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7",
"refsource": "MISC",
"url": "https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7"
},
{
"name": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1",
"refsource": "MISC",
"url": "https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
"assignerShortName": "GitHub_P",
"cveId": "CVE-2021-22861",
"datePublished": "2021-03-03T03:25:21",
"dateReserved": "2021-01-06T00:00:00",
"dateUpdated": "2024-08-03T18:51:07.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2021-22861\",\"sourceIdentifier\":\"product-cna@github.com\",\"published\":\"2021-03-03T04:15:13.070\",\"lastModified\":\"2024-11-21T05:50:47.123\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.\"},{\"lang\":\"es\",\"value\":\"Se identific\u00f3 una vulnerabilidad de control de acceso inadecuada en GitHub Enterprise Server que permit\u00eda a los usuarios autenticados de la instancia obtener acceso de escritura a repositorios no autorizados a trav\u00e9s de solicitudes de extracci\u00f3n y solicitudes de API REST espec\u00edficamente dise\u00f1adas. Un atacante tendr\u00eda que ser capaz de bifurcar el repositorio objetivo, una configuraci\u00f3n que est\u00e1 desactivada por defecto para los repositorios privados propiedad de la organizaci\u00f3n. Las protecciones de la rama, como las revisiones requeridas de las solicitudes de extracci\u00f3n o las comprobaciones de estado, evitar\u00edan que las confirmaciones no autorizadas se fusionaran sin una revisi\u00f3n o validaci\u00f3n adicional. Esta vulnerabilidad afectaba a todas las versiones de GitHub Enterprise Server desde la versi\u00f3n 2.4.21 y fue corregida en las versiones 2.20.24, 2.21.15, 2.22.7 y 3.0.1. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"2.4.21\",\"versionEndExcluding\":\"2.20.24\",\"matchCriteriaId\":\"C6B741E9-F328-4CD0-B82C-A8A4E26A1894\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"2.21.0\",\"versionEndExcluding\":\"2.21.15\",\"matchCriteriaId\":\"33F7B688-318D-452D-A804-49984D527FDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"2.22.0\",\"versionEndExcluding\":\"2.22.7\",\"matchCriteriaId\":\"5333B472-BF06-4427-9344-72CD5B2429CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:github:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.0.1\",\"matchCriteriaId\":\"6929FFB5-AC83-412F-A6FF-0593F64A0688\"}]}]}],\"references\":[{\"url\":\"https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1\",\"source\":\"product-cna@github.com\"},{\"url\":\"https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.