| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| enterprise server | ≥ 3.15.0, < 3.15.16≥ 3.16.0, < 3.16.12≥ 3.17.0, < 3.17.9≥ 3.18.0, < 3.18.3< 3.14.21 | 3.15.163.16.123.17.93.18.33.14.21 |
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン