CVE-2021-41599 Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution

2022-02-1723:35:12

CWE-77

GitHub_P

www.cve.org

github

enterprise server

code execution

vulnerability

bug bounty

EPSS

0.007

Percentile

80.4%

JSON

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program.

CNA Affected

[
  {
    "product": "GitHub Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "lessThan": "3.0.21",
        "status": "affected",
        "version": "3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "3.1.13",
        "status": "affected",
        "version": "3.1",
        "versionType": "custom"
      },
      {
        "lessThan": "3.2.5",
        "status": "affected",
        "version": "3.2",
        "versionType": "custom"
      }
    ]
  }
]