GitHub Enterprise Server における不正な認証に関する脆弱性
| Title |
GitHub Enterprise Server における不正な認証に関する脆弱性
|
| Summary |
GitHub Enterprise Server には、不正な認証に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
April 1, 2021, midnight |
| Registration Date |
Dec. 9, 2021, 5:32 p.m. |
| Last Update |
Dec. 9, 2021, 5:32 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
|
CVSS2.0 : 警告
|
| Score |
4.3
|
| Vector |
AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected System
| GitHub |
|
GitHub Enterprise 3.0.4 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年12月09日]
掲載 |
Dec. 9, 2021, 5:32 p.m. |
NVD Vulnerability Information
CVE-2021-22865
| Summary |
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read private repository metadata via the REST API without having been granted the appropriate permissions. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. The private repository metadata returned would be limited to repositories owned by the user the token identifies. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.4 and was fixed in versions 3.0.4, 2.22.10, 2.21.18. This vulnerability was reported via the GitHub Bug Bounty program.
|
| Publication Date |
April 3, 2021, 3:15 a.m. |
| Registration Date |
April 3, 2021, 10:03 a.m. |
| Last Update |
Nov. 21, 2024, 2:50 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* |
3.0.0 |
|
|
3.0.4 |
| cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* |
2.22.0 |
|
|
2.22.10 |
| cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* |
|
|
|
2.21.18 |
Related information, measures and tools
Common Vulnerabilities List