From 06278f8de2791d05426559e8b13e1543290b50b8 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 24 Jun 2024 20:40:49 +0000
Subject: [PATCH] Publish Advisories

GHSA-7q3h-j95q-3vjh
GHSA-m7r8-2r98-vppj
---
 .../GHSA-7q3h-j95q-3vjh.json                  | 32 ++++++++++++++++---
 .../GHSA-m7r8-2r98-vppj.json                  | 32 ++++++++++++++++---
 2 files changed, 56 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json (67%)
 rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json (66%)

diff --git a/advisories/unreviewed/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json b/advisories/github-reviewed/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json
similarity index 67%
rename from advisories/unreviewed/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json
rename to advisories/github-reviewed/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json
index a2609cc1ed7..c6d54625b9e 100644
--- a/advisories/unreviewed/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json
+++ b/advisories/github-reviewed/2024/06/GHSA-7q3h-j95q-3vjh/GHSA-7q3h-j95q-3vjh.json
@@ -1,26 +1,50 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7q3h-j95q-3vjh",
-  "modified": "2024-06-22T06:30:37Z",
+  "modified": "2024-06-24T20:40:17Z",
   "published": "2024-06-22T06:30:37Z",
   "aliases": [
     "CVE-2024-21519"
   ],
+  "summary": "Arbitrary File Creation in opencart",
   "details": "This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file with an arbitrary filename (including the extension), within /system/storage/backup.\n\n**Note:**\n\nIt is less likely for the created file to be available within the web root, as part of the security recommendations for the application suggest moving the storage path outside of the web root.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "opencart/opencart"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21519"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/opencart/opencart"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/opencart/opencart/blob/master/upload/admin/controller/tool/upload.php%23L353"
@@ -35,8 +59,8 @@
       "CWE-20"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-24T20:40:17Z",
     "nvd_published_at": "2024-06-22T05:15:11Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json b/advisories/github-reviewed/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json
similarity index 66%
rename from advisories/unreviewed/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json
rename to advisories/github-reviewed/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json
index ee9a06de0d3..0a399708e8c 100644
--- a/advisories/unreviewed/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json
+++ b/advisories/github-reviewed/2024/06/GHSA-m7r8-2r98-vppj/GHSA-m7r8-2r98-vppj.json
@@ -1,26 +1,50 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m7r8-2r98-vppj",
-  "modified": "2024-06-22T06:30:37Z",
+  "modified": "2024-06-24T20:39:16Z",
   "published": "2024-06-22T06:30:37Z",
   "aliases": [
     "CVE-2024-21518"
   ],
+  "summary": "Zip slip in opencart",
   "details": "This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "opencart/opencart"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21518"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/opencart/opencart"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1"
@@ -35,8 +59,8 @@
       "CWE-29"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-24T20:39:16Z",
     "nvd_published_at": "2024-06-22T05:15:11Z"
   }
 }
\ No newline at end of file