Read the docs
TI-2020-08451 Aliases CVE-2020-10517GHSA-38rx-7wc7-6jvw

Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names

Priority LOW 22CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program.

Why it matters now

EPSS 0.0105 64th percentileScored 2026-11-07
Fix Fixed GitHub Enterprise Server (GitHub): 2.21.6, 2.20.15, 2.19.21

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitHubGitHub Enterprise Server2.21 to before 2.21.6; 2.20 to before 2.20.15; 2.19 to before 2.19.212.21.6, 2.20.15, 2.19.21Patch availableCNA
  • GitHub Enterprise Server VendorGitHub Affected 2.21 to before 2.21.6; 2.20 to before 2.20.15; 2.19 to before 2.19.21 Fixed in 2.21.6, 2.20.15, 2.19.21 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*before 2.19.21; 2.20.0 to before 2.20.15; 2.21.0 to before 2.21.6VulnerableGitHub
  • cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:* Versions before 2.19.21; 2.20.0 to before 2.20.15; 2.21.0 to before 2.21.6 Vulnerable ·GitHub

Remediation

  • Fix · CNA GitHub Enterprise Server (GitHub) Fixed in 2.21.6, 2.20.15, 2.19.21

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitHub Enterprise Server 2.19.21, 2.20.15, 2.21.6

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-08452 Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10517
  2. 2026-10-03 Alias added: GHSA-38rx-7wc7-6jvw

References

Advisory 3

  • TI-2017-13538 The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization… CVSS 3.0CRITICAL 9.8
  • TI-2020-08450 Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member CVSS 3.1CRITICAL 9.8
  • TI-2020-08453 Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server CVSS 3.1HIGH 8.8
  • TI-2020-08452 Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server CVSS 3.1HIGH 8.8
  • TI-2021-05724 Improper authorization in GitHub Enterprise Server CVSS 3.1HIGH 8.1
  • TI-2012-01828 GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide… CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences