From 1a602a22a9c5356781f405f2f1b9a03fe39983ac Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 28 Dec 2023 18:46:35 +0000
Subject: [PATCH] Publish Advisories

GHSA-rqxc-9p8h-xqgq
GHSA-xhvv-3jww-c487
---
 .../GHSA-rqxc-9p8h-xqgq.json                  | 17 +++-
 .../GHSA-xhvv-3jww-c487.json                  | 77 +++++++++++++++++++
 2 files changed, 90 insertions(+), 4 deletions(-)
 create mode 100644 advisories/github-reviewed/2023/12/GHSA-xhvv-3jww-c487/GHSA-xhvv-3jww-c487.json

diff --git a/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json b/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json
index 612370d7797..2d0c9edbcf0 100644
--- a/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json
+++ b/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json
@@ -1,13 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rqxc-9p8h-xqgq",
-  "modified": "2023-12-27T15:07:14Z",
+  "modified": "2023-12-28T18:45:19Z",
   "published": "2023-12-24T06:30:31Z",
+  "withdrawn": "2023-12-28T18:45:19Z",
   "aliases": [
-    "CVE-2023-51763"
+
   ],
-  "summary": "ActiveAdmin vulnerable to CSV injection",
-  "details": "csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.",
+  "summary": "Duplicate Advisory: ActiveAdmin vulnerable to CSV injection",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xhvv-3jww-c487. This link is maintained to preserve external references.\n\n## Original Description\ncsv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -55,6 +56,14 @@
     {
       "type": "WEB",
       "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-rqxc-9p8h-xqgq"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-51763.yml"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2023/12/GHSA-xhvv-3jww-c487/GHSA-xhvv-3jww-c487.json b/advisories/github-reviewed/2023/12/GHSA-xhvv-3jww-c487/GHSA-xhvv-3jww-c487.json
new file mode 100644
index 00000000000..0b6fa7dd834
--- /dev/null
+++ b/advisories/github-reviewed/2023/12/GHSA-xhvv-3jww-c487/GHSA-xhvv-3jww-c487.json
@@ -0,0 +1,77 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xhvv-3jww-c487",
+  "modified": "2023-12-28T18:45:30Z",
+  "published": "2023-12-28T18:45:30Z",
+  "aliases": [
+    "CVE-2023-51763"
+  ],
+  "summary": "ActiveAdmin CSV Injection leading to sensitive information disclosure",
+  "details": "### Impact\n\nIn ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.\n\nThe attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.\n\n### Patches\n\nVersions 3.2.0 and above fixed the problem by escaping any data starting with `=` and other characters used by spreadsheet programs.\n\n### Workarounds\n\nOnly turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.  \n\n### References\n\nhttps://owasp.org/www-community/attacks/CSV_Injection\nhttps://github.com/activeadmin/activeadmin/pull/8167",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "activeadmin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.2.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51763"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/activeadmin/activeadmin/pull/8167"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/activeadmin/activeadmin"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-51763.yml"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1236"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-12-28T18:45:30Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file