PT-2021-15239 · Github · Github Enterprise Server

Vaibhav Singh · Published 2021-05-14 · Updated 2021-05-25 · CVE-2021-22866

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 2.22.x prior to 2.22.13 GitHub Enterprise Server versions 3.0.x prior to 3.0.7

Description A UI misrepresentation issue was identified that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user. To exploit this, an attacker would need to create a GitHub App and have a user authorize it. During the initial authorization, all permissions are properly shown, but if the user revisits the authorization flow after the GitHub App configures additional user-level permissions, those extra permissions may not be displayed, leading to more permissions being granted than intended.

Recommendations For GitHub Enterprise Server versions 2.22.x prior to 2.22.13, update to version 2.22.13 to resolve the issue. For GitHub Enterprise Server versions 3.0.x prior to 3.0.7, update to version 3.0.7 to resolve the issue.

Fix

Clickjacking

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-1021

CWE-451

Related Identifiers

CVE-2021-22866

Affected Products

Github Enterprise Server

References · 4

• https://osv.dev/vulnerability/CVE-2021-22866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22866 · Security Note
• https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.13 · Note
• https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.7 · Note