From 0a6f4ef2ae750f0160aae4d6ee10ca94f25df157 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 11 Apr 2025 20:00:16 +0000 Subject: [PATCH] Publish Advisories GHSA-4h9j-f98m-p4hg GHSA-2xm2-23ff-p8ww GHSA-p9hh-mh5x-wvx3 GHSA-4h9j-f98m-p4hg --- .../GHSA-4h9j-f98m-p4hg.json | 69 +++++++++++++++++++ .../GHSA-2xm2-23ff-p8ww.json | 64 +++++++++++++++++ .../GHSA-p9hh-mh5x-wvx3.json | 64 +++++++++++++++++ .../GHSA-4h9j-f98m-p4hg.json | 39 ----------- 4 files changed, 197 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-2xm2-23ff-p8ww/GHSA-2xm2-23ff-p8ww.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-p9hh-mh5x-wvx3/GHSA-p9hh-mh5x-wvx3.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json diff --git a/advisories/github-reviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json b/advisories/github-reviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json new file mode 100644 index 00000000000..4abed8b4789 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4h9j-f98m-p4hg", + "modified": "2025-04-11T19:59:37Z", + "published": "2022-05-02T06:19:32Z", + "aliases": [ + "CVE-2010-1153" + ], + "summary": "TYPO3 PHP remote file inclusion vulnerability", + "details": "PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1153" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20100813082506/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008" + }, + { + "type": "WEB", + "url": "http://marc.info/?l=oss-security&m=127092306209177&w=2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2010/04/12/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T19:59:37Z", + "nvd_published_at": "2010-04-20T19:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-2xm2-23ff-p8ww/GHSA-2xm2-23ff-p8ww.json b/advisories/github-reviewed/2025/04/GHSA-2xm2-23ff-p8ww/GHSA-2xm2-23ff-p8ww.json new file mode 100644 index 00000000000..65f9da9ee7b --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-2xm2-23ff-p8ww/GHSA-2xm2-23ff-p8ww.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2xm2-23ff-p8ww", + "modified": "2025-04-11T19:59:04Z", + "published": "2025-04-11T19:59:04Z", + "aliases": [ + "CVE-2025-32426" + ], + "summary": "Formie has XSS vulnerability for email notification content for preview", + "details": "### Impact\nIt is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email).\n\nThis would require access to the form's email notification settings.\n\n### Patches\nThis has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "verbb/formie" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.44" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.1.43" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/verbb/formie/security/advisories/GHSA-2xm2-23ff-p8ww" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32426" + }, + { + "type": "PACKAGE", + "url": "https://github.com/verbb/formie" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T19:59:04Z", + "nvd_published_at": "2025-04-11T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-p9hh-mh5x-wvx3/GHSA-p9hh-mh5x-wvx3.json b/advisories/github-reviewed/2025/04/GHSA-p9hh-mh5x-wvx3/GHSA-p9hh-mh5x-wvx3.json new file mode 100644 index 00000000000..be7a6315ad1 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-p9hh-mh5x-wvx3/GHSA-p9hh-mh5x-wvx3.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p9hh-mh5x-wvx3", + "modified": "2025-04-11T19:58:38Z", + "published": "2025-04-11T19:58:38Z", + "aliases": [ + "CVE-2025-32427" + ], + "summary": "Formie has XSS vulnerability for importing forms", + "details": "### Impact\nWhen importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported.\n\nAs imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export.\n\n### Patches\nThis has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "verbb/formie" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.44" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.1.43" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/verbb/formie/security/advisories/GHSA-p9hh-mh5x-wvx3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32427" + }, + { + "type": "PACKAGE", + "url": "https://github.com/verbb/formie" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T19:58:38Z", + "nvd_published_at": "2025-04-11T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json b/advisories/unreviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json deleted file mode 100644 index f3e7b0dcf42..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-4h9j-f98m-p4hg/GHSA-4h9j-f98m-p4hg.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4h9j-f98m-p4hg", - "modified": "2025-04-11T03:34:07Z", - "published": "2022-05-02T06:19:32Z", - "aliases": [ - "CVE-2010-1153" - ], - "details": "PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1153" - }, - { - "type": "WEB", - "url": "http://marc.info/?l=oss-security&m=127092306209177&w=2" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2010/04/12/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2010-04-20T19:30:00Z" - } -} \ No newline at end of file