From 1d2c1f84487607eb78e811170783934893a8f5e0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 16 Jan 2024 15:25:14 +0000
Subject: [PATCH] Publish Advisories
GHSA-62jr-84gf-wmg4
GHSA-ghjv-mh6x-7q6h
---
.../GHSA-62jr-84gf-wmg4.json | 65 +++++++++++++++++++
.../GHSA-ghjv-mh6x-7q6h.json | 64 ++++++++++++++++++
2 files changed, 129 insertions(+)
create mode 100644 advisories/github-reviewed/2024/01/GHSA-62jr-84gf-wmg4/GHSA-62jr-84gf-wmg4.json
create mode 100644 advisories/github-reviewed/2024/01/GHSA-ghjv-mh6x-7q6h/GHSA-ghjv-mh6x-7q6h.json
diff --git a/advisories/github-reviewed/2024/01/GHSA-62jr-84gf-wmg4/GHSA-62jr-84gf-wmg4.json b/advisories/github-reviewed/2024/01/GHSA-62jr-84gf-wmg4/GHSA-62jr-84gf-wmg4.json
new file mode 100644
index 00000000000..ef47e748c07
--- /dev/null
+++ b/advisories/github-reviewed/2024/01/GHSA-62jr-84gf-wmg4/GHSA-62jr-84gf-wmg4.json
@@ -0,0 +1,65 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-62jr-84gf-wmg4",
+ "modified": "2024-01-16T15:24:41Z",
+ "published": "2024-01-16T15:24:41Z",
+ "aliases": [
+ "CVE-2024-22207"
+ ],
+ "summary": "Default swagger-ui configuration exposes all files in the module",
+ "details": "### Impact\n\nThe default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.\n\n### Patches\n\nUpdate to v2.1.0\n\n### Workarounds\n\nUse the `baseDir` option\n\n### References\n\n[HackerOne report\n](https://hackerone.com/reports/2312369).",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "npm",
+ "name": "@fastify/swagger-ui"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2.0.0"
+ },
+ {
+ "fixed": "2.1.0"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4"
+ },
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22207"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/fastify/fastify-swagger-ui"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-1188"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2024-01-16T15:24:41Z",
+ "nvd_published_at": "2024-01-15T16:15:13Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/01/GHSA-ghjv-mh6x-7q6h/GHSA-ghjv-mh6x-7q6h.json b/advisories/github-reviewed/2024/01/GHSA-ghjv-mh6x-7q6h/GHSA-ghjv-mh6x-7q6h.json
new file mode 100644
index 00000000000..fd5acffca45
--- /dev/null
+++ b/advisories/github-reviewed/2024/01/GHSA-ghjv-mh6x-7q6h/GHSA-ghjv-mh6x-7q6h.json
@@ -0,0 +1,64 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-ghjv-mh6x-7q6h",
+ "modified": "2024-01-16T15:24:00Z",
+ "published": "2024-01-16T15:24:00Z",
+ "aliases": [
+ "CVE-2024-22191"
+ ],
+ "summary": "avo vulnerable to stored cross-site scripting (XSS) in key_value field",
+ "details": "### Summary\nA **stored cross-site scripting (XSS)** vulnerability was found in the **key_value** field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser.\n\n### Details\nThe value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code.\n\nThis vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser.\n\nIn [avo/fields/common/key_value_component.html.erb]( https://github.com/avo-hq/avo/blob/main/app/components/avo/fields/common/key_value_component.html.erb#L38C21-L38C33) the value is taken in lines **38** and **49** and seems to be interpreted directly as html in lines **44** and **55**.\n\n### PoC\n\n\n\n\nTo reproduce the vulnerability, follow these steps:\n\n1. Edit an entry with a key_value field.\n2. Enter the following payload into the value field:\n```POC\\\"> Outside-tag