From 175509e0ccaf67cdfba283f2bb7f913298e2142b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 10 Apr 2023 16:38:59 +0000
Subject: [PATCH] Publish Advisories

GHSA-xc93-587g-mxm7
GHSA-9hcr-9hcv-x6pv
---
 .../GHSA-xc93-587g-mxm7.json                  | 31 +++++++--
 .../GHSA-9hcr-9hcv-x6pv.json                  | 69 +++++++++++++++++++
 2 files changed, 96 insertions(+), 4 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json (58%)
 create mode 100644 advisories/github-reviewed/2023/04/GHSA-9hcr-9hcv-x6pv/GHSA-9hcr-9hcv-x6pv.json

diff --git a/advisories/unreviewed/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json b/advisories/github-reviewed/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json
similarity index 58%
rename from advisories/unreviewed/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json
rename to advisories/github-reviewed/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json
index c829b83931a..3b78c58c0a8 100644
--- a/advisories/unreviewed/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json
+++ b/advisories/github-reviewed/2023/03/GHSA-xc93-587g-mxm7/GHSA-xc93-587g-mxm7.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xc93-587g-mxm7",
-  "modified": "2023-04-07T18:30:50Z",
+  "modified": "2023-04-10T16:38:33Z",
   "published": "2023-03-30T21:30:21Z",
   "aliases": [
     "CVE-2023-28462"
   ],
+  "summary": "Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed",
   "details": "A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "fish.payara.server:payara-aggregator"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.2020.1"
+            },
+            {
+              "fixed": "6.2022.1.Alpha3"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -24,6 +43,10 @@
     {
       "type": "WEB",
       "url": "https://blog.payara.fish/vulnerability-affecting-server-environments-on-java-1.8-on-updates-lower-than-1.8u191"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/payara/Payara"
     }
   ],
   "database_specific": {
@@ -31,8 +54,8 @@
 
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-04-10T16:38:33Z",
     "nvd_published_at": "2023-03-30T20:15:00Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/github-reviewed/2023/04/GHSA-9hcr-9hcv-x6pv/GHSA-9hcr-9hcv-x6pv.json b/advisories/github-reviewed/2023/04/GHSA-9hcr-9hcv-x6pv/GHSA-9hcr-9hcv-x6pv.json
new file mode 100644
index 00000000000..b2c9353b24c
--- /dev/null
+++ b/advisories/github-reviewed/2023/04/GHSA-9hcr-9hcv-x6pv/GHSA-9hcr-9hcv-x6pv.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9hcr-9hcv-x6pv",
+  "modified": "2023-04-10T16:37:40Z",
+  "published": "2023-04-10T16:37:40Z",
+  "aliases": [
+    "CVE-2023-29005"
+  ],
+  "summary": "Flask-AppBuilder Has No Rate Limiting on Login AUTH DB",
+  "details": "### Impact\nLack of rate limiting will allow an attacker to brute-force user credentials.\n\n### Patches\nAbility to enable rate limiting on Flask-AppBuilder >=  4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication.\n\n### Workarounds\nImplement rate limiting using a reverse proxy or other strategies. \n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "Flask-AppBuilder"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.3.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dpgaspar/Flask-AppBuilder/pull/1976"
+    },
+    {
+      "type": "WEB",
+      "url": "https://flask-limiter.readthedocs.io/en/stable/configuration.html"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/dpgaspar/Flask-AppBuilder"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.3.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-307"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-04-10T16:37:40Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file