Threats tagged 'ghsa-34h8-2q57-6h55'

A cross-site request forgery (CSRF) vulnerability in GitHub Enterprise Server prior to version 3.23 allowed unauthenticated attackers to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials. Exploitation required an authenticated Management Console operator to visit attacker-controlled content, which would trigger a cross-site GET request lacking a CSRF token to the integration removal endpoint. This could disrupt ChatOps notifications and commands when configurations were applied or services reloaded. The issue was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3.