CVE-2021-22870
Assigner: GitHub_P
Published: 2021-11-10T01:55:11
State: PUBLISHED
affected: product: GitHub Enterprise Server
vendor: GitHub
versions: lessThan: 3.0.19
status: affected
version: 3.0
versionType: custom
lessThan: 3.1.11
status: affected
version: 3.1
versionType: custom
lessThan: 3.2.3
status: affected
version: 3.2
versionType: custom
credits: value: yvvdwf
descriptions: value: A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program.
problemTypes: descriptions: cweId: CWE-23
description: CWE-23
type: CWE
source: discovery: EXTERNAL
title: Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access