PT-2021-15243 · Github · Github Enterprise Server

Yvvdwf · Published 2021-11-10 · Updated 2021-11-16 · CVE-2021-22870

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.3 GitHub Enterprise Server version 3.0 through 3.0.18 GitHub Enterprise Server version 3.1 through 3.1.10 GitHub Enterprise Server version 3.2 through 3.2.2

Description A path traversal issue was identified in GitHub Pages builds that could allow an attacker to read system files. To exploit this, an attacker would need permission to create and build a GitHub Pages site.

Recommendations For GitHub Enterprise Server versions prior to 3.0.19, update to version 3.0.19. For GitHub Enterprise Server versions 3.1, update to version 3.1.11. For GitHub Enterprise Server versions 3.2, update to version 3.2.3.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2021-22870

Affected Products

Github Enterprise Server

References · 5

• https://osv.dev/vulnerability/CVE-2021-22870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22870 · Security Note
• https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.3 · Note
• https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.11 · Note
• https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.19 · Note