CVE-2021-41599CWE-77

Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution

published February 17, 2022

CVSS
—
EPSS
2%
Percentile
82.6
In the wild
Unconfirmed
What it is

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02223 · 82.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2022-02-17T23:35Z
EPSS history
Timeline
  • 17 FEB 23:35Z
    Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution
    cvelistv5