CVE-2012-2055

EPSS 1.07%
Published 05.04.2012 14:55:06
Last modified 11.04.2025 00:51:21
Source cve@mitre.org
CVE-Watchlists
Login
Open
Login

GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability.

Affected products Warnungen 0 Metrics 3 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Github ≫ Github SwEditionenterprise Version < 20120304

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.07%	0.757

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-913 Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

http://homakov.blogspot.com/2012/03/how-to.html

Issue Tracking

http://lwn.net/Articles/488702/

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/74812

Third Party Advisory

VDB Entry

https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2012-2055

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2012-2055

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2012-2055

EUVD