Threats tagged 'ghsa-xqmx-3vx6-fm88'

A reflected HTML injection vulnerability exists in the GitHub Enterprise Server Management Console login page. The flaw involves the redirect_to query parameter on the /setup/unlock endpoint being reflected into an HTML attribute without proper sanitization. This allows an attacker to inject a form element that could capture administrator credentials if the administrator clicks a crafted link and enters their credentials. The vulnerability affects GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1 and was fixed in versions 3.19.6 and 3.20.2.