PT-2022-11438 · Github · Github Enterprise Server

Vaibhav Singh · Published 2022-01-25 · Updated 2022-02-01 · CVE-2021-41598

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.3

Description A UI misrepresentation issue was identified that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this, an attacker would need to create a GitHub App and have a user authorize it through the web authentication flow. The issue occurred when a user updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, leading to more permissions being granted than the user potentially intended.

Recommendations For versions prior to 3.2.5, update to version 3.2.5 or later. For versions prior to 3.1.13, update to version 3.1.13 or later. For versions prior to 3.0.21, update to version 3.0.21 or later. As a temporary workaround, consider restricting the use of GitHub Apps that configure additional user-level permissions until a patch is available.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2021-41598

Affected Products

Github Enterprise Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-41598 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41598 · Vendor Advisory
• https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13 · Note
• https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21 · Note
• https://t.me/cvenotify/26111 · Telegram Post
• https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5 · Note