Griffinf

**Name of the Vulnerable Software and Affected Versions** GitHub Enterprise Server versions prior to 3.22 **Description** A server-side request forgery (SSRF) issue exists in the Manage API, allowing an unauthenticated attacker to force the server to send crafted outbound requests to a host under their control. This occurs because an unauthenticated endpoint parses a cluster configuration provided by the attacker and issues gateway-to-agent requests where the HMAC (Hash-based Message Authentication Code, a mechanism for verifying data integrity and authenticity) only authenticates a timestamp rather than the request path or body. An attacker capable of intercepting these outbound requests can capture the token and replay it against privileged management agent endpoints. High-availability deployments are not affected. **Recommendations** Update to version 3.17.19 Update to version 3.18.13 Update to version 3.19.10 Update to version 3.20.6 Update to version 3.21.4