mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-2xpq-xp6c-5mgj GHSA-4p75-5p53-65m9 GHSA-vm6r-j788-hjh5
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,115 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2xpq-xp6c-5mgj",
|
||||
"modified": "2024-09-17T14:59:02Z",
|
||||
"published": "2024-09-17T14:59:02Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45612"
|
||||
],
|
||||
"summary": "Contao affected by insert tag injection via canonical URL",
|
||||
"details": "### Impact\n\nIt is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.\n\n### Patches\n\nUpdate to Contao 4.13.49, 5.3.15 or 5.4.3.\n\n### Workarounds\n\nDisable canonical tags in the settings of the website root page.\n\n### References\n\nhttps://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.13.0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.13.49"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "5.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "5.3.15"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "5.4.0"
|
||||
},
|
||||
{
|
||||
"fixed": "5.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/contao/contao"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-09-17T14:59:02Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4p75-5p53-65m9",
|
||||
"modified": "2024-09-17T14:58:45Z",
|
||||
"published": "2024-09-17T14:58:45Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45604"
|
||||
],
|
||||
"summary": "Contao affected by directory traversal in the file selector widget",
|
||||
"details": "### Impact\n\nBack end users can list files outside their file mounts or the document root in the FileSelector widget.\n\n### Patches\n\nUpdate to Contao 4.13.49.\n\n### Workarounds\n\nNone.\n\n### References\n\nhttps://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).\n\n### Credits\n\nThanks to Jakob Steeg from usd AG for reporting this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.13.49"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/63409c6bdfd95197d9906e229d765b630d45742e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/contao/contao"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-22"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-09-17T14:58:45Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vm6r-j788-hjh5",
|
||||
"modified": "2024-09-17T14:58:35Z",
|
||||
"published": "2024-09-17T14:58:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45398"
|
||||
],
|
||||
"summary": "Contao affected by remote command execution through file upload",
|
||||
"details": "### Impact\n\nBack end users with access to the file manager can upload malicious files and execute them on the server.\n\n### Patches\n\nUpdate to Contao 4.13.49, 5.3.15 or 5.4.3.\n\n### Workarounds\n\nConfigure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.\n\n### References\n\nhttps://contao.org/en/security-advisories/remote-command-execution-through-file-uploads\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).\n\n### Credits\n\nThanks to Jakob Steeg from usd AG for reporting this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.13.49"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "5.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "5.3.15"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "contao/core-bundle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "5.4.0"
|
||||
},
|
||||
{
|
||||
"fixed": "5.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/9445d509f12a7f1b68a4794dcc5e3e459b363ebb"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/a7e39f96ac8fdc281f7caaa96e01deb0e24ac7d3"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/contao/contao/commit/f3db59ffe5a6c0e1f705b3230ebd5ff16865280e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/contao/contao"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-434"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-09-17T14:58:35Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user