CVE-2021-22861

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:github:github:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:30

Type Values Removed Values Added
References
  • {'url': 'https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1', 'name': 'https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1', 'tags': ['Release Notes', 'Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24', 'name': 'https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24', 'tags': ['Release Notes', 'Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15', 'name': 'https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15', 'tags': ['Release Notes', 'Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7', 'name': 'https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7', 'tags': ['Release Notes', 'Vendor Advisory'], 'refsource': 'MISC'}
  • () https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15 -
  • () https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1 -
  • () https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7 -
  • () https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24 -

25 Oct 2022, 13:09

Type Values Removed Values Added
CWE CWE-863 NVD-CWE-Other

09 Mar 2021, 15:25

Type Values Removed Values Added
CWE CWE-863
CVSS v2 : unknown
v3 : unknown
v2 : 4.0
v3 : 6.5
CPE cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:github:github:*:*:*:*:*:*:*:*
References (MISC) https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1 - (MISC) https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.1 - Release Notes, Vendor Advisory
References (MISC) https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24 - (MISC) https://docs.github.com/en/enterprise-server@2.20/admin/release-notes#2.20.24 - Release Notes, Vendor Advisory
References (MISC) https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7 - (MISC) https://docs.github.com/en/enterprise-server@2.22/admin/release-notes#2.22.7 - Release Notes, Vendor Advisory
References (MISC) https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15 - (MISC) https://docs.github.com/en/enterprise-server@2.21/admin/release-notes#2.21.15 - Release Notes, Vendor Advisory

03 Mar 2021, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-03-03 04:15

Updated : 2023-12-10 13:41


NVD link : CVE-2021-22861

Mitre link : CVE-2021-22861

CVE.ORG link : CVE-2021-22861


JSON object : View

Products Affected

github

  • github
CWE
NVD-CWE-Other CWE-285

Improper Authorization