A vulnerability was found in GitHub Enterprise Server up to 2.22.16/3.0.10/3.1.2 (Bug Tracking Software) and classified as problematic. Affected by this issue is an unknown function of the component Pages Site. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality.

The weakness was disclosed 07/15/2021. The advisory is available at docs.github.com. This vulnerability is handled as CVE-2021-22867. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 2.22.17, 3.0.11 or 3.1.3 eliminates this vulnerability. The upgrade is hosted for download at docs.github.com.

The entries VDB-183341, VDB-193311 and VDB-221325 are pretty similar.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 2.22.0
• 2.22.1
• 2.22.2
• 2.22.3
• 2.22.4
• 2.22.5
• 2.22.6
• 2.22.7
• 2.22.8
• 2.22.9
• 2.22.10
• 2.22.11
• 2.22.12
• 2.22.13
• 2.22.14
• 2.22.15
• 2.22.16
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.1.0
• 3.1.1
• 3.1.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion