Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #12718 Repositories under the Enalean organization on GitHub have wikis writable to anyone
    Actions
    Infos
    #12718
    Thomas Gerbet (tgerbet)
    2019-01-10 11:15
    2019-01-07 11:00
    13487
    Details
    Repositories under the Enalean organization on GitHub have wikis writable to anyone

    Multiple projects under the Enalean organization on GitHub (https://github.com/Enalean) are writable to anyone without any restrictions.

    Impact

    A malicious user could exploit this to tarnish the project's reputation or to phish users as the content found in these wikis could be considered as safe.

    Other
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2019-01-07
    Attachments
    Empty
    References
    References list is empty
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2019-01-10 11:15
    The reporter has revoked his/her consent to be credited for finding the issue, his/her name has been expunged from the artifact.
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2019-01-07 11:09
    Crediting XXXXXXXXXXXXXXXXX for the finding and report.
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2019-01-07 11:07
    Actions have been taken to fix the issue:
    * wikis have been disabled
    * permissions have been set to only allow members with push access to edit the wikis if they are enabled back one day
    • Status changed from Under implementation to Closed
    • Close date set to 2019-01-07