by Kastro
Paper/Archive/CVE-2020-10516

CVE-2020-10516

GitHub GitHub Enterprise Server — Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 75.7.757 × 2015.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.

Affected

ProductAffectedFixed inSource
GitHub Enterprise Server2.20 – < 2.20.92.20.9CNA
GitHub Enterprise Server2.19 – < 2.19.152.19.15CNA
GitHub Enterprise Server2.18 – < 2.18.202.18.20CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refenterprise.github.com/releases/2.20.9/notesrefenterprise.github.com/releases/2.19.15/notesrefenterprise.github.com/releases/2.18.20/notes