A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack…
A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Se
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- GitHub
- Product
- Enterprise Server
- CVSS v4.0
- 5.3 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Fix
- available
- Weakness
- CWE-352
- Exposure class
- Collaboration, Developer platform
- NVD status
- Received
Why it ranks 19 (Routine)
- CVSS v4.0 5.3 medium
- Product class: collaboration, developer platform
- Widely deployed vendor product (GitHub)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.