CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10516 – Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member
https://notcve.org/view.php?id=CVE-2020-10516
An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program. Se identificó una vulnerabilidad de control de acceso inapropiado en la API de GitHub Enterprise Server, que permitió a un miembro de la organización escalar permisos y conseguir acceso a repositorios no autorizados dentro de una organización. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a 2.21 y fue corregida en las versiones 2.20.9, 2.19.15 y 2.18.20. • https://enterprise.github.com/releases/2.18.20/notes https://enterprise.github.com/releases/2.19.15/notes https://enterprise.github.com/releases/2.20.9/notes • CWE-285: Improper Authorization CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-2055
https://notcve.org/view.php?id=CVE-2012-2055
GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability. GitHub Enterprise antes de v20120304 no restringe debidamente el uso de un hash para proporcionar los valores para un modelo de atributos, lo que permite a atacantes remotos establecer el valor public_key [user_id] a través de una URL modificada para el formulario de actualización de clave pública. Se trata de un problema relacionado con una vulnerabilidad de "asignación en masa". • http://homakov.blogspot.com/2012/03/how-to.html http://lwn.net/Articles/488702 https://exchange.xforce.ibmcloud.com/vulnerabilities/74812 https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation • CWE-913: Improper Control of Dynamically-Managed Code Resources •