What is CVE-2021-22869?

CVE-2021-22869 is an improper access control vulnerability in GitHub Enterprise Server that allowed a workflow job to execute in a self-hosted runner group it should not have had access to.

Who is affected by CVE-2021-22869?

Customers using self-hosted runner groups for access control in GitHub Enterprise Server versions 3.0.0 to 3.0.16 and 3.1.0 to 3.1.8 are affected by CVE-2021-22869.

What is the severity of CVE-2021-22869?

CVE-2021-22869 has a severity rating of 9.8 (Critical).

How can I fix CVE-2021-22869?

To fix CVE-2021-22869, it is recommended to update GitHub Enterprise Server to version 3.0.17 or 3.1.9, which contains the necessary security patches.

Where can I find more information about CVE-2021-22869?

You can find more information about CVE-2021-22869 in the release notes of GitHub Enterprise Server versions 3.0.16 and 3.1.8.

Vulnerability/
CVE-2021-22869

critical

9.8

CWE

287 668

24/9/2021

25/10/2022

CVE-2021-22869

First published: Fri Sep 24 2021(Updated: )

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group could access all of the enterprise runner groups within the organization because of improper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runner group. This vulnerability affected GitHub Enterprise Server versions from 3.0.0 to 3.0.15 and 3.1.0 to 3.1.7 and was fixed in 3.0.16 and 3.1.8 releases.

Credit: product-cna@github.com

Affected Software	Affected Version	How to fix
GitHub Enterprise Server	>=3.0.0<3.0.16
GitHub Enterprise Server	>=3.1.0<3.1.8

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2021-22869?
CVE-2021-22869 is an improper access control vulnerability in GitHub Enterprise Server that allowed a workflow job to execute in a self-hosted runner group it should not have had access to.
Who is affected by CVE-2021-22869?
Customers using self-hosted runner groups for access control in GitHub Enterprise Server versions 3.0.0 to 3.0.16 and 3.1.0 to 3.1.8 are affected by CVE-2021-22869.
What is the severity of CVE-2021-22869?
CVE-2021-22869 has a severity rating of 9.8 (Critical).
How can I fix CVE-2021-22869?
To fix CVE-2021-22869, it is recommended to update GitHub Enterprise Server to version 3.0.17 or 3.1.9, which contains the necessary security patches.
Where can I find more information about CVE-2021-22869?
You can find more information about CVE-2021-22869 in the release notes of GitHub Enterprise Server versions 3.0.16 and 3.1.8.

collector/nvd-index
vendor/github
canonical/github enterprise server
version/github enterprise server/3.0.0
version/github enterprise server/3.1.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.