Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Network
0

CVE-2020-15272

Disclosure Date: October 26, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the tag input] or manage to alter the value of [the GITHUB_REF environment variable]. The problem has been patched in version 1.0.1. If you don’t use the tag input you are most likely safe. The GITHUB_REF environment variable is protected by the GitHub Actions environment so attacks from there should be impossible. If you must use the tag input and cannot upgrade to > 1.0.0 make sure that the value is not controlled by another Action.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
9.6 Critical
Impact Score:
5.8
Exploitability Score:
3.1
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
None

General Information

Additional Info

Technical Analysis