Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- GitHub Enterprise Server
From 3.14.0 · through 3.14.23; From 3.15.0 · through 3.15.18; From 3.16.0 · through 3.16.14; From 3.17.0 · through 3.17.11; From 3.18.0 · through 3.18.5; From 3.19.0 · through 3.19.2
References 7
docs.github.com
- en/enterprise-server@3.14/admin/release-notes#3.14.24
- en/enterprise-server@3.15/admin/release-notes#3.15.19
- en/enterprise-server@3.16/admin/release-notes#3.16.15
- en/enterprise-server@3.17/admin/release-notes#3.17.12
- en/enterprise-server@3.18/admin/release-notes#3.18.6
- en/enterprise-server@3.19/admin/release-notes#3.19.3