CVE-2020-10517: 
NixOS vulnerability analysis and mitigation

An improper access control vulnerability (CVE-2020-10517) was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. The vulnerability was reported through the GitHub Bug Bounty program (NVD, Release Notes).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-285 (Improper Authorization). The issue only allowed access to repository names and did not permit unauthorized access to any other repository content (NVD).

The vulnerability's impact was limited to information disclosure of private repository names. Attackers could only obtain the names of unauthorized private repositories if they knew their numerical IDs, but could not access any other repository content (NVD, Release Notes).

The vulnerability requires authentication to exploit, meaning only authenticated users of the GitHub Enterprise Server instance could potentially exploit this vulnerability. The attacker would need to know the numerical IDs of private repositories to obtain their names (NVD).

The vulnerability was patched in GitHub Enterprise Server versions 2.21.6, 2.20.15, and 2.19.21. Users are advised to upgrade to these versions or later to address the vulnerability (Release Notes).