diff --git a/advisories/github-reviewed/2022/05/GHSA-vm9c-39jx-q45w/GHSA-vm9c-39jx-q45w.json b/advisories/github-reviewed/2022/05/GHSA-vm9c-39jx-q45w/GHSA-vm9c-39jx-q45w.json new file mode 100644 index 00000000000..2ebcc3e0320 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-vm9c-39jx-q45w/GHSA-vm9c-39jx-q45w.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vm9c-39jx-q45w", + "modified": "2025-05-08T17:35:23Z", + "published": "2022-05-13T01:12:54Z", + "aliases": [ + "CVE-2013-4522" + ], + "summary": "Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor", + "details": "lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send \"Cache-Control: private\" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0-beta" + }, + { + "fixed": "2.4.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0-beta" + }, + { + "fixed": "2.5.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4522" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/d0041fb110201d3dc1a4546eca8b6108b440d1c5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=244479" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38743" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2013/11/25/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-08T17:35:23Z", + "nvd_published_at": "2013-11-26T05:25:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json b/advisories/github-reviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json new file mode 100644 index 00000000000..51837861140 --- /dev/null +++ b/advisories/github-reviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9q29-jcjw-fw7h", + "modified": "2025-05-08T17:35:51Z", + "published": "2022-08-17T00:00:17Z", + "aliases": [ + "CVE-2020-14321" + ], + "summary": "Moodle Incorrect Authorization vulnerability", + "details": "In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9.0-beta" + }, + { + "fixed": "3.9.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0-beta" + }, + { + "fixed": "3.8.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0-beta" + }, + { + "fixed": "3.7.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.13" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14321" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/d07fb8b9e8bf47fe60ad2aea553329bd1fb96e37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=407393" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-05-08T17:35:51Z", + "nvd_published_at": "2022-08-16T21:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vm9c-39jx-q45w/GHSA-vm9c-39jx-q45w.json b/advisories/unreviewed/2022/05/GHSA-vm9c-39jx-q45w/GHSA-vm9c-39jx-q45w.json deleted file mode 100644 index a1d280290c7..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-vm9c-39jx-q45w/GHSA-vm9c-39jx-q45w.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vm9c-39jx-q45w", - "modified": "2022-05-13T01:12:54Z", - "published": "2022-05-13T01:12:54Z", - "aliases": [ - "CVE-2013-4522" - ], - "details": "lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send \"Cache-Control: private\" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4522" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=244479" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38743" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2013/11/25/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2013-11-26T05:25:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json b/advisories/unreviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json deleted file mode 100644 index 67cdaf313ac..00000000000 --- a/advisories/unreviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9q29-jcjw-fw7h", - "modified": "2022-08-18T00:00:17Z", - "published": "2022-08-17T00:00:17Z", - "aliases": [ - "CVE-2020-14321" - ], - "details": "In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14321" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=407393" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-08-16T21:15:00Z" - } -} \ No newline at end of file