CVE-2012-2055

Опубликовано: 05 апр. 2012

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability.

Ссылки

http://homakov.blogspot.com/2012/03/how-to.html
Issue Tracking
http://lwn.net/Articles/488702/
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/74812
Third Party Advisory
VDB Entry
https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation
Vendor Advisory
http://homakov.blogspot.com/2012/03/how-to.html
Issue Tracking
http://lwn.net/Articles/488702/
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/74812
Third Party Advisory
VDB Entry
https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*

Версия до 20120304 (исключая)

EPSS

Процентиль: 77%

0.01066

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-913

Связанные уязвимости

GHSA-8qp2-79w8-8586