Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-03-26 18:32:14 +00:00
parent 8a51400af0
commit 0b92fc9490
32 changed files with 423 additions and 33 deletions
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-56p6-qw3c-fq2g",
+  "modified": "2025-03-26T18:30:43Z",
+  "published": "2025-03-26T18:30:43Z",
+  "aliases": [
+    "CVE-2025-30351"
+  ],
+  "summary": "Suspended Directus user can continue to use session token to access API",
+  "details": "### Summary\nSince the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.\n\n### Details\nThere is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. Right now one can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires.\n\n### PoC\n* Create an active user\n* Log in with that user and note the session cookie\n* Suspend the user (and don't trigger an `/auth/refresh` call, as that invalidates the session\n* Access the API with `Authorization: Bearer <token>`\n\n### Impact\nThis weakens the security of suspending users.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "directus"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "10.10.0"
+            },
+            {
+              "fixed": "11.15.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/directus/directus"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-672"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-26T18:30:43Z",
+    "nvd_published_at": null
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-43rm-m793-9q62",
-  "modified": "2022-04-14T00:00:27Z",
+  "modified": "2025-03-26T18:30:34Z",
  "published": "2022-04-08T00:00:23Z",
  "aliases": [
    "CVE-2022-25338"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c2r8-h7hq-477v",
-  "modified": "2022-04-16T00:01:30Z",
+  "modified": "2025-03-26T18:30:34Z",
  "published": "2022-04-08T00:00:23Z",
  "aliases": [
    "CVE-2022-25339"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8ph5-68pq-3fm9",
-  "modified": "2022-05-24T17:42:40Z",
+  "modified": "2025-03-26T18:30:33Z",
  "published": "2022-05-24T17:42:40Z",
  "aliases": [
    "CVE-2020-36250"
  ],
  "details": "In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-v933-rrv9-44p3",
-  "modified": "2022-05-24T17:42:40Z",
+  "modified": "2025-03-26T18:30:33Z",
  "published": "2022-05-24T17:42:40Z",
  "aliases": [
    "CVE-2020-36248"
  ],
  "details": "The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g84p-hgf8-8vg5",
-  "modified": "2023-02-09T18:30:28Z",
+  "modified": "2025-03-26T18:30:35Z",
  "published": "2023-02-03T03:30:25Z",
  "aliases": [
    "CVE-2022-47130"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47130"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenXP-Research/CVE-2022-47130"
+    },
    {
      "type": "WEB",
      "url": "https://portswigger.net/web-security/csrf"
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-77"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-r3fh-95rm-cx6p",
-  "modified": "2023-02-15T00:30:38Z",
+  "modified": "2025-03-26T18:30:42Z",
  "published": "2023-02-06T15:30:23Z",
  "aliases": [
    "CVE-2022-48019"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vpjc-3v2r-p99w",
-  "modified": "2023-02-09T18:30:28Z",
+  "modified": "2025-03-26T18:30:35Z",
  "published": "2023-02-03T03:30:25Z",
  "aliases": [
    "CVE-2022-47131"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://blog.hackingforce.com.br/en/xss"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenXP-Research/CVE-2022-47131"
+    },
    {
      "type": "WEB",
      "url": "https://portswigger.net/web-security/csrf"
@@ -42,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-352"
+      "CWE-352",
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -26,6 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-306",
+      "CWE-352",
      "CWE-863"
    ],
    "severity": "MODERATE",
@@ -30,7 +30,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-125"
+      "CWE-125",
+      "CWE-126"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-307"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-352"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gcvf-qqcq-825h",
-  "modified": "2024-04-11T06:30:34Z",
+  "modified": "2025-03-26T18:30:44Z",
  "published": "2024-04-09T00:30:41Z",
  "aliases": [
    "CVE-2024-27632"
  ],
  "details": "An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -27,7 +32,7 @@
    "cwe_ids": [
      "CWE-335"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-08T22:15:08Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rfj8-v7wf-3hfc",
-  "modified": "2024-04-03T06:30:48Z",
+  "modified": "2025-03-26T18:30:43Z",
  "published": "2024-04-03T06:30:48Z",
  "aliases": [
    "CVE-2024-2322"
  ],
  "details": "The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-03T05:15:47Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9mq7-wpm3-gv26",
-  "modified": "2025-03-01T03:30:51Z",
+  "modified": "2025-03-26T18:30:44Z",
  "published": "2024-05-21T18:31:23Z",
  "aliases": [
    "CVE-2024-22273"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-v5pv-v2xp-jjp2",
-  "modified": "2024-05-22T15:31:00Z",
+  "modified": "2025-03-26T18:30:44Z",
  "published": "2024-05-22T15:31:00Z",
  "aliases": [
    "CVE-2024-35554"
  ],
  "details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -23,7 +28,7 @@
    "cwe_ids": [
      "CWE-352"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-22T14:15:09Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mjh6-hm62-6x3r",
-  "modified": "2024-11-12T00:30:35Z",
+  "modified": "2025-03-26T18:30:45Z",
  "published": "2024-07-26T21:31:16Z",
  "aliases": [
    "CVE-2024-40116"
  ],
  "details": "An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -27,7 +32,7 @@
    "cwe_ids": [
      "CWE-256"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-26T20:15:04Z"
--- a/Show More
+++ b/Show More