From 03a110859c8c940e877f98a6bfac46bdb97e7b2b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 12 Feb 2024 11:53:17 +0000 Subject: [PATCH] Publish Advisories GHSA-273r-v888-vgc6 GHSA-86pc-6mm8-542r GHSA-f73h-224c-62qr GHSA-p783-gj6m-9r88 --- .../GHSA-273r-v888-vgc6/GHSA-273r-v888-vgc6.json | 10 +++++++--- .../GHSA-86pc-6mm8-542r/GHSA-86pc-6mm8-542r.json | 14 +++++++++++--- .../GHSA-f73h-224c-62qr/GHSA-f73h-224c-62qr.json | 10 +++++++--- .../GHSA-p783-gj6m-9r88/GHSA-p783-gj6m-9r88.json | 14 +++++++++++--- 4 files changed, 36 insertions(+), 12 deletions(-) diff --git a/advisories/github-reviewed/2022/05/GHSA-273r-v888-vgc6/GHSA-273r-v888-vgc6.json b/advisories/github-reviewed/2022/05/GHSA-273r-v888-vgc6/GHSA-273r-v888-vgc6.json index c4e13e95275..37737813f7a 100644 --- a/advisories/github-reviewed/2022/05/GHSA-273r-v888-vgc6/GHSA-273r-v888-vgc6.json +++ b/advisories/github-reviewed/2022/05/GHSA-273r-v888-vgc6/GHSA-273r-v888-vgc6.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-273r-v888-vgc6", - "modified": "2024-01-10T16:22:11Z", + "modified": "2024-02-12T11:51:26Z", "published": "2022-05-24T17:00:28Z", "aliases": [ "CVE-2019-8153" ], "summary": "Magento Cross-site Scripting (XSS)", - "details": "A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the `escapeURL()` function and execute a malicious XSS payload.", + "details": "A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the `escapeURL()` function and execute a malicious XSS payload.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.", "severity": [ { "type": "CVSS_V3", @@ -47,7 +47,7 @@ "introduced": "2.3.0" }, { - "fixed": "2.3.3" + "fixed": "2.3.2-p2" } ] } @@ -67,6 +67,10 @@ "type": "WEB", "url": "https://github.com/magento/magento2/commit/f5eb758c12a2c40ba3fe38ce44b46192494f4ff8" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8153.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/magento/magento2" diff --git a/advisories/github-reviewed/2022/05/GHSA-86pc-6mm8-542r/GHSA-86pc-6mm8-542r.json b/advisories/github-reviewed/2022/05/GHSA-86pc-6mm8-542r/GHSA-86pc-6mm8-542r.json index 548f4d28c79..401c0440821 100644 --- a/advisories/github-reviewed/2022/05/GHSA-86pc-6mm8-542r/GHSA-86pc-6mm8-542r.json +++ b/advisories/github-reviewed/2022/05/GHSA-86pc-6mm8-542r/GHSA-86pc-6mm8-542r.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-86pc-6mm8-542r", - "modified": "2023-08-01T22:37:47Z", + "modified": "2024-02-12T11:51:03Z", "published": "2022-05-24T17:00:28Z", "aliases": [ "CVE-2019-8148" ], "summary": "Magento 2 Community Edition XSS Vulnerability", - "details": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.", + "details": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n", "severity": [ { "type": "CVSS_V3", @@ -28,7 +28,7 @@ "introduced": "2.3.0" }, { - "fixed": "2.3.3" + "fixed": "2.3.2-p2" } ] } @@ -40,6 +40,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8148" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8148.yaml" + }, + { + "type": "WEB", + "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" + }, { "type": "WEB", "url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" diff --git a/advisories/github-reviewed/2022/05/GHSA-f73h-224c-62qr/GHSA-f73h-224c-62qr.json b/advisories/github-reviewed/2022/05/GHSA-f73h-224c-62qr/GHSA-f73h-224c-62qr.json index dc085c5de00..277aedd7488 100644 --- a/advisories/github-reviewed/2022/05/GHSA-f73h-224c-62qr/GHSA-f73h-224c-62qr.json +++ b/advisories/github-reviewed/2022/05/GHSA-f73h-224c-62qr/GHSA-f73h-224c-62qr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-f73h-224c-62qr", - "modified": "2024-01-10T16:30:59Z", + "modified": "2024-02-12T11:51:51Z", "published": "2022-05-24T17:00:29Z", "aliases": [ "CVE-2019-8151" ], "summary": "Magento Server-Side Request Forgery (SSRF)", - "details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-side request forgery due to unsafe handling of a carrier gateway.", + "details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-side request forgery due to unsafe handling of a carrier gateway.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n", "severity": [ { "type": "CVSS_V3", @@ -47,7 +47,7 @@ "introduced": "2.3.0" }, { - "fixed": "2.3.3" + "fixed": "2.3.2-p2" } ] } @@ -59,6 +59,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8151" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8151.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/magento/magento2" diff --git a/advisories/github-reviewed/2022/05/GHSA-p783-gj6m-9r88/GHSA-p783-gj6m-9r88.json b/advisories/github-reviewed/2022/05/GHSA-p783-gj6m-9r88/GHSA-p783-gj6m-9r88.json index 1e4e775f832..84bb5fbd2e3 100644 --- a/advisories/github-reviewed/2022/05/GHSA-p783-gj6m-9r88/GHSA-p783-gj6m-9r88.json +++ b/advisories/github-reviewed/2022/05/GHSA-p783-gj6m-9r88/GHSA-p783-gj6m-9r88.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-p783-gj6m-9r88", - "modified": "2023-09-26T19:26:31Z", + "modified": "2024-02-12T11:52:14Z", "published": "2022-05-24T17:00:29Z", "aliases": [ "CVE-2019-8150" ], "summary": "Magento 2 Community Edition RCE Vulnerability", - "details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout.", + "details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.", "severity": [ { "type": "CVSS_V3", @@ -47,7 +47,7 @@ "introduced": "2.3.0" }, { - "fixed": "2.3.2-p1" + "fixed": "2.3.2-p2" } ] } @@ -59,10 +59,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8150" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8150.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/magento/magento2" }, + { + "type": "WEB", + "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" + }, { "type": "WEB", "url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"