From 10fe10b21fe423673cd81ccae397ccd827eb2d47 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 25 Jul 2024 00:32:43 +0000 Subject: [PATCH] Publish Advisories GHSA-9jp8-rx43-82gm GHSA-h8h7-r99g-m28c GHSA-pqgh-rchr-9hg3 GHSA-q2f3-hg8j-4wcc --- .../GHSA-9jp8-rx43-82gm.json | 42 ++++++++++++++++ .../GHSA-h8h7-r99g-m28c.json | 38 ++++++++++++++ .../GHSA-pqgh-rchr-9hg3.json | 38 ++++++++++++++ .../GHSA-q2f3-hg8j-4wcc.json | 50 +++++++++++++++++++ 4 files changed, 168 insertions(+) create mode 100644 advisories/unreviewed/2024/07/GHSA-9jp8-rx43-82gm/GHSA-9jp8-rx43-82gm.json create mode 100644 advisories/unreviewed/2024/07/GHSA-h8h7-r99g-m28c/GHSA-h8h7-r99g-m28c.json create mode 100644 advisories/unreviewed/2024/07/GHSA-pqgh-rchr-9hg3/GHSA-pqgh-rchr-9hg3.json create mode 100644 advisories/unreviewed/2024/07/GHSA-q2f3-hg8j-4wcc/GHSA-q2f3-hg8j-4wcc.json diff --git a/advisories/unreviewed/2024/07/GHSA-9jp8-rx43-82gm/GHSA-9jp8-rx43-82gm.json b/advisories/unreviewed/2024/07/GHSA-9jp8-rx43-82gm/GHSA-9jp8-rx43-82gm.json new file mode 100644 index 00000000000..91d2f525300 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-9jp8-rx43-82gm/GHSA-9jp8-rx43-82gm.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9jp8-rx43-82gm", + "modified": "2024-07-25T00:31:16Z", + "published": "2024-07-25T00:31:16Z", + "aliases": [ + "CVE-2024-0231" + ], + "details": "A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0231" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2299337" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/437103" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-99" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-24T23:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-h8h7-r99g-m28c/GHSA-h8h7-r99g-m28c.json b/advisories/unreviewed/2024/07/GHSA-h8h7-r99g-m28c/GHSA-h8h7-r99g-m28c.json new file mode 100644 index 00000000000..e281d099125 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-h8h7-r99g-m28c/GHSA-h8h7-r99g-m28c.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h8h7-r99g-m28c", + "modified": "2024-07-25T00:31:17Z", + "published": "2024-07-25T00:31:17Z", + "aliases": [ + "CVE-2024-7091" + ], + "details": "An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7091" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/408469" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-pqgh-rchr-9hg3/GHSA-pqgh-rchr-9hg3.json b/advisories/unreviewed/2024/07/GHSA-pqgh-rchr-9hg3/GHSA-pqgh-rchr-9hg3.json new file mode 100644 index 00000000000..bb867c298ef --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-pqgh-rchr-9hg3/GHSA-pqgh-rchr-9hg3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pqgh-rchr-9hg3", + "modified": "2024-07-25T00:31:17Z", + "published": "2024-07-25T00:31:17Z", + "aliases": [ + "CVE-2024-7060" + ], + "details": "An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7060" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/437894" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-24T23:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-q2f3-hg8j-4wcc/GHSA-q2f3-hg8j-4wcc.json b/advisories/unreviewed/2024/07/GHSA-q2f3-hg8j-4wcc/GHSA-q2f3-hg8j-4wcc.json new file mode 100644 index 00000000000..794fb83a559 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-q2f3-hg8j-4wcc/GHSA-q2f3-hg8j-4wcc.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q2f3-hg8j-4wcc", + "modified": "2024-07-25T00:31:16Z", + "published": "2024-07-25T00:31:16Z", + "aliases": [ + "CVE-2024-5067" + ], + "details": "An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5067" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2462303" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2502047" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-24T23:15:09Z" + } +} \ No newline at end of file