Github Enterprise Server any version

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program.

Unsafe Reflection in Github Enterprise Server leading to Command Injection

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.

Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens

Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group

Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion

DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server

An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header

Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution

Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack

Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

Remote code execution via git push option injection in GitHub Enterprise Server

Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution

Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution

Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages

Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections

Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user

UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resources

Path traversal in GitHub Enterprise Server leading to remote code execution

Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions

Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass

Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access

Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests

Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML

Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token