SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-22862

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork.

MEDIUM 6.5EPSS 0.81%

Does this matter?

Lower severity and a low EPSS score (0.81%). Track it; it rarely justifies an emergency change on its own.

Description

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS 3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.81% probability · 55th percentile
CISA KEV
Not listed
Weakness
CWE-285
Affected
github/github
Source
product-cna@github.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.