CVE-2012-2055

GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability.

• CWE-913

• http://homakov.blogspot.com/2012/03/how-to.htmlIssue Tracking
• http://lwn.net/Articles/488702/Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74812Third Party Advisory, VDB Entry
• https://github.com/blog/1068-public-key-security-vulnerability-and-mitigationVendor Advisory
• http://homakov.blogspot.com/2012/03/how-to.htmlIssue Tracking
• http://lwn.net/Articles/488702/Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74812Third Party Advisory, VDB Entry
• https://github.com/blog/1068-public-key-security-vulnerability-and-mitigationVendor Advisory

Published

Apr 5, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-2049Stack-based buffer overflow in Adobe Reader and Acrobat 9.x …
• CVE-2012-2050Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2…
• CVE-2012-2051Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10…
• CVE-2012-2052Stack-based buffer overflow in the U3D.8BI library plugin in…
• CVE-2012-2053The sudoers file in the Linux system configuration in F5 Fir…
• CVE-2012-2054Redmine before 1.3.2 does not properly restrict the use of a…
• CVE-2012-2056Cross-site request forgery (CSRF) vulnerability in the Conte…
• CVE-2012-2057Cross-site request forgery (CSRF) vulnerability in the Uberc…
• CVE-2012-2058The Ubercart Payflow module for Drupal does not use a secure…
• CVE-2012-2059Cross-site scripting (XSS) vulnerability in the ticketyboo N…
• CVE-2012-2060Cross-site scripting (XSS) vulnerability in the Admin tools …
• CVE-2012-2061Cross-site request forgery (CSRF) vulnerability in the Admin…