From 04ac7cae699ebaddd35ffb496ca65dd8259f2fb1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 22 Apr 2024 23:15:43 +0000 Subject: [PATCH] Publish Advisories GHSA-fw45-938v-p26j GHSA-jv4c-7jqq-m34x GHSA-wgxm-rg53-h2c6 GHSA-wgxm-rg53-h2c6 --- .../GHSA-fw45-938v-p26j.json | 33 ++++++++-- .../GHSA-jv4c-7jqq-m34x.json | 42 +++++++++--- .../GHSA-wgxm-rg53-h2c6.json | 65 +++++++++++++++++++ .../GHSA-wgxm-rg53-h2c6.json | 39 ----------- 4 files changed, 127 insertions(+), 52 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json (57%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json (53%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json diff --git a/advisories/unreviewed/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json b/advisories/github-reviewed/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json rename to advisories/github-reviewed/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json index 62ded7d96c7..e33b776501a 100644 --- a/advisories/unreviewed/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json +++ b/advisories/github-reviewed/2022/05/GHSA-fw45-938v-p26j/GHSA-fw45-938v-p26j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fw45-938v-p26j", - "modified": "2022-05-24T22:01:34Z", + "modified": "2024-04-22T23:15:04Z", "published": "2022-05-24T22:01:34Z", "aliases": [ "CVE-2021-20088" ], + "summary": "mootools-more vulnerable to prototype pollution", "details": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "mootools-more" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.6.0" + } + ] + } + ] + } ], "references": [ { @@ -24,15 +43,19 @@ { "type": "WEB", "url": "https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mootools/mootools-more" } ], "database_specific": { "cwe_ids": [ - + "CWE-1321" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:15:04Z", "nvd_published_at": "2021-04-23T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json b/advisories/github-reviewed/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json rename to advisories/github-reviewed/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json index 19b83dc4905..208f4022883 100644 --- a/advisories/unreviewed/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json +++ b/advisories/github-reviewed/2022/05/GHSA-jv4c-7jqq-m34x/GHSA-jv4c-7jqq-m34x.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-jv4c-7jqq-m34x", - "modified": "2022-05-24T17:40:21Z", + "modified": "2024-04-22T23:14:44Z", "published": "2022-05-24T17:40:21Z", "aliases": [ "CVE-2021-26271" ], + "summary": "CKEditor 4 ReDoS Vulnerability", "details": "It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "ckeditor4-dev" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.16" + } + ] + } + ] + } ], "references": [ { @@ -19,13 +41,17 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26271" }, { - "type": "WEB", - "url": "https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first" + "type": "PACKAGE", + "url": "https://github.com/ckeditor/ckeditor4" }, { "type": "WEB", "url": "https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416" }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20210128132707/https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first" + }, { "type": "WEB", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" @@ -37,11 +63,11 @@ ], "database_specific": { "cwe_ids": [ - "CWE-829" + "CWE-1333" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:14:44Z", "nvd_published_at": "2021-01-26T21:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json b/advisories/github-reviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json new file mode 100644 index 00000000000..69482bc6b67 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wgxm-rg53-h2c6", + "modified": "2024-04-22T23:14:16Z", + "published": "2022-05-24T17:37:25Z", + "aliases": [ + "CVE-2020-28276" + ], + "summary": "Prototype pollution vulnerability in 'deep-set'", + "details": "The NPM module 'deep-set' can be abused by Prototype Pollution vulnerability since the function `deepSet()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.\n\n### PoC\n```js\nvar deepSet = require('deep-set')\nvar obj = {'1':'2'}\nconsole.log(obj.isAdmin);\ndeepSet(obj, '__proto__.isAdmin', 'true')\nconsole.log(obj.isAdmin);\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "deep-set" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "last_affected": "1.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28276" + }, + { + "type": "PACKAGE", + "url": "https://github.com/klaemo/deep-set" + }, + { + "type": "WEB", + "url": "https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20210320110509/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28276" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:14:16Z", + "nvd_published_at": "2020-12-29T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json b/advisories/unreviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json deleted file mode 100644 index f5c5f3522e4..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-wgxm-rg53-h2c6/GHSA-wgxm-rg53-h2c6.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wgxm-rg53-h2c6", - "modified": "2022-05-24T17:37:25Z", - "published": "2022-05-24T17:37:25Z", - "aliases": [ - "CVE-2020-28276" - ], - "details": "Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28276" - }, - { - "type": "WEB", - "url": "https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39" - }, - { - "type": "WEB", - "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28276" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-12-29T17:15:00Z" - } -} \ No newline at end of file