diff --git a/advisories/unreviewed/2022/05/GHSA-jgwg-35hf-xqrr/GHSA-jgwg-35hf-xqrr.json b/advisories/github-reviewed/2022/05/GHSA-jgwg-35hf-xqrr/GHSA-jgwg-35hf-xqrr.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-jgwg-35hf-xqrr/GHSA-jgwg-35hf-xqrr.json rename to advisories/github-reviewed/2022/05/GHSA-jgwg-35hf-xqrr/GHSA-jgwg-35hf-xqrr.json index d55c5349dad..1d57c57f16a 100644 --- a/advisories/unreviewed/2022/05/GHSA-jgwg-35hf-xqrr/GHSA-jgwg-35hf-xqrr.json +++ b/advisories/github-reviewed/2022/05/GHSA-jgwg-35hf-xqrr/GHSA-jgwg-35hf-xqrr.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-jgwg-35hf-xqrr", - "modified": "2022-05-13T01:12:23Z", + "modified": "2023-07-19T19:30:34Z", "published": "2022-05-13T01:12:23Z", "aliases": [ "CVE-2019-3876" ], - "details": "A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.", + "summary": "OpenShift OAuth Server XSS Vulnerability", + "details": "A flaw was found in the `/oauth/token/request` custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/openshift/oauth-apiserver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.11" + } + ] + } + ] + } ], "references": [ { @@ -39,7 +58,7 @@ }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/107664" + "url": "https://web.archive.org/web/20210126211309/http://www.securityfocus.com/bid/107664" } ], "database_specific": { @@ -47,8 +66,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-07-19T19:30:34Z", "nvd_published_at": "2019-04-01T15:29:00Z" } } \ No newline at end of file