PT-2020-12187 · Github · Github Enterprise Server

William Bowling · Published 2020-08-27 · Updated 2021-10-07 · CVE-2020-10517

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 2.22 GitHub Enterprise Server version 2.21.6 GitHub Enterprise Server version 2.20.15 GitHub Enterprise Server version 2.19.21

Description An improper access control issue was identified in GitHub Enterprise Server, allowing authenticated users to determine the names of unauthorized private repositories given their numerical IDs. This issue did not allow unauthorized access to any repository content besides the name. The issue was reported via the GitHub Bug Bounty program.

Recommendations For GitHub Enterprise Server versions prior to 2.22, update to version 2.22 or later to resolve the issue. For GitHub Enterprise Server version 2.21.6, no additional action is required as this version already contains the fix. For GitHub Enterprise Server version 2.20.15, no additional action is required as this version already contains the fix. For GitHub Enterprise Server version 2.19.21, no additional action is required as this version already contains the fix.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2020-10517

Affected Products

Github Enterprise Server

References · 6

• https://enterprise.github.com/releases/2.19.21/notes · Vendor Advisory
• https://enterprise.github.com/releases/2.20.15/notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10517 · Vendor Advisory
• https://enterprise.github.com/releases/2.21.6/notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10517 · Security Note
• https://t.me/cibsecurity/14362 · Telegram Post