地图 / RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention

RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention

错误配置 / 错误配置 / #2357443

厂商: GitHub
严重程度: 低危
赏金: —
弱点: 错误配置
研究员: @inspector-ambitious
披露日期: 2024-09-17
资产: GitHub Enterprise Server
CVE: CVE-2024-2440

该报告还没有中文解读。

时间线

2024-02-07报告提交
2024-09-17公开披露

阅读 HackerOne 原文 ↗作者 @inspector-ambitious · 版权归作者与 GitHub 所有

同类报告

Spring Actuator endpoints publicly available and broken authenticationLY Corporation · 2020-08-06 · $12,500 Internal Access to Hackerone confluence DocsHackerOne · 2025-08-15 · $12,500 Ability To Delete User(s) Account Without User InteractionGitLab · 2021-03-17 Spring Actuator endpoints publicly available, leading to account takeoverLY Corporation · 2020-08-04 · $5,000 Session Cookie Leakage via Static Header Field in WebViewerFragmentLinkedIn · 2026-03-17 Wordpress Takeover using setup configuration at http://████.edu [HtUS]U.S. Dept Of Defense · 2023-01-13 · $1,000