« Volver al listado

CVE-2020-10516

Estado: ModificadaCrítica (9.8)—

An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Github — Github

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-10516",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "product-cna@github.com",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "GitHub Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "version": "2.20",
              "lessThan": "2.20.9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.19",
              "lessThan": "2.19.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.18",
              "lessThan": "2.18.20",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-03T14:15:12.377",
  "references": [
    {
      "url": "https://enterprise.github.com/releases/2.18.20/notes",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://enterprise.github.com/releases/2.19.15/notes",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://enterprise.github.com/releases/2.20.9/notes",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://enterprise.github.com/releases/2.18.20/notes",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://enterprise.github.com/releases/2.19.15/notes",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://enterprise.github.com/releases/2.20.9/notes",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-cna@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program."
    },
    {
      "lang": "es",
      "value": "Se identificó una vulnerabilidad de control de acceso inapropiado en la API de GitHub Enterprise Server, que permitió a un miembro de la organización escalar permisos y conseguir acceso a repositorios no autorizados dentro de una organización. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a 2.21 y fue corregida en las versiones 2.20.9, 2.19.15 y 2.18.20. Esta vulnerabilidad fue reportada por medio del programa GitHub Bug Bounty."
    }
  ],
  "lastModified": "2026-06-17T02:47:57.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D3E4C5E-345B-47A7-95DE-27FA144652F7",
              "versionEndExcluding": "2.18.20",
              "versionStartIncluding": "2.18.0"
            },
            {
              "criteria": "cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BB3EC19-93F9-4D28-8F30-9B659CB2F3E4",
              "versionEndExcluding": "2.19.15",
              "versionStartIncluding": "2.19.0"
            },
            {
              "criteria": "cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE0B3224-DAA6-4EC5-B70D-4328F397511E",
              "versionEndExcluding": "2.20.9",
              "versionStartIncluding": "2.20.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-cna@github.com"
}