A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an …
High CVSS 7.4
Summary
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6
Timeline
- nvd_ingest NVD