diff --git a/advisories/unreviewed/2024/09/GHSA-g84q-54hf-36rg/GHSA-g84q-54hf-36rg.json b/advisories/github-reviewed/2024/09/GHSA-g84q-54hf-36rg/GHSA-g84q-54hf-36rg.json similarity index 55% rename from advisories/unreviewed/2024/09/GHSA-g84q-54hf-36rg/GHSA-g84q-54hf-36rg.json rename to advisories/github-reviewed/2024/09/GHSA-g84q-54hf-36rg/GHSA-g84q-54hf-36rg.json index 141c8ef6fae..ac5a4edf1a1 100644 --- a/advisories/unreviewed/2024/09/GHSA-g84q-54hf-36rg/GHSA-g84q-54hf-36rg.json +++ b/advisories/github-reviewed/2024/09/GHSA-g84q-54hf-36rg/GHSA-g84q-54hf-36rg.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-g84q-54hf-36rg", - "modified": "2024-09-11T15:31:12Z", + "modified": "2024-09-18T22:11:39Z", "published": "2024-09-11T15:31:12Z", "aliases": [ "CVE-2024-6091" ], - "details": "A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.", + "summary": "AutoGPT bypass of the shell commands denylist settings", + "details": "A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as `whoami` and `/bin/whoami`. An attacker can circumvent this restriction by executing commands with a modified path, such as `/bin/./whoami`, which is not recognized by the denylist.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "agpt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.5.1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +48,10 @@ "type": "WEB", "url": "https://github.com/significant-gravitas/autogpt/commit/ef691359b774a1f9f80cf4f5ace9821967b718ed" }, + { + "type": "PACKAGE", + "url": "https://github.com/Significant-Gravitas/AutoGPT" + }, { "type": "WEB", "url": "https://huntr.com/bounties/8a742c13-bb5e-4bc9-8b86-049d8a386050" @@ -35,8 +62,8 @@ "CWE-78" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-18T22:11:39Z", "nvd_published_at": "2024-09-11T13:15:03Z" } } \ No newline at end of file