RCE in Ericcornelissen Git-Tag-Annotation-Action
CVE-2020-15272
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version 1.0.1. If you don't use the `tag` input you are most likely safe. The `GITHUB_REF` environment variable is protected by the GitHub Actions environment so attacks from there should be impossible. If you must use the `tag` input and cannot upgrade to `> 1.0.0` make sure that the value is not controlled by another Action.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.012 (66.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Ericcornelissen Git-Tag-Annotation-Action — versions < 1.0.1
- Git-Tag-Annotation-Action Project
Weakness classification (CWE)
References
- github.com/ericcornelissen/git-tag-annotation-action/security/advisories/GHSA-h… (Third Party Advisory)
- github.com/ericcornelissen/git-tag-annotation-action/commit/9f30756375cc4b1b6c6… (Patch, Third Party Advisory)
- github.com/ericcornelissen/git-tag-annotation-action/releases/tag/v1.0.1 (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15272?
- CVE-2020-15272 is a high-severity vulnerability in Ericcornelissen Git-Tag-Annotation-Action, classified under OS Command Injection. CVSS score: 8.7/10. Published 2020-10-26.
- How severe is CVE-2020-15272?
- High severity. CVSS v3 base score is 8.7 out of 10.