A reflected HTML injection vulnerability (CWE-79) exists in the GitHub Enterprise Server Management Console login page due to improper neutralization of input in the redirect_to query parameter on the /setup/unlock endpoint. This parameter is reflected into an HTML attribute without proper sanitization, enabling injection of a form element that can capture administrator credentials. Exploitation requires user interaction by an administrator clicking a malicious link and submitting credentials. The vulnerability affects versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1 and was resolved in versions 3.19.6 and 3.20.2. No known exploits in the wild have been reported.

Successful exploitation could lead to credential theft of administrators by injecting malicious HTML that captures login information. This could compromise administrative access to the GitHub Enterprise Server Management Console. The vulnerability requires user interaction and is limited to affected versions prior to 3.19.6 and 3.20.2. The CVSS score of 5.9 reflects a medium impact with network attack vector, low attack complexity, and high confidentiality impact.

A fix is available in GitHub Enterprise Server versions 3.19.6 and 3.20.2. Users should upgrade to these or later versions to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the official patches. No additional mitigation guidance is provided in the vendor advisory.