CVE-2021-22870CWE-23

Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access

published November 10, 2021

CVSS
—
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01134 · 66.2th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2021-11-10T01:55Z
EPSS history
Timeline
  • 10 NOV 01:55Z
    Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access
    cvelistv5