diff --git a/advisories/github-reviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json b/advisories/github-reviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json new file mode 100644 index 00000000000..54177f835be --- /dev/null +++ b/advisories/github-reviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json @@ -0,0 +1,202 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3m36-mjwj-352c", + "modified": "2024-05-15T20:51:56Z", + "published": "2022-02-12T00:00:47Z", + "aliases": [ + "CVE-2020-13672" + ], + "summary": "Drupal core Cross-site Scripting (XSS) vulnerability", + "details": "Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.80" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.9.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.1.0" + }, + { + "fixed": "9.1.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.80" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.9.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.1.0" + }, + { + "fixed": "9.1.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13672" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2021-002" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-15T20:51:56Z", + "nvd_published_at": "2022-02-11T16:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json b/advisories/github-reviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json new file mode 100644 index 00000000000..aa4e9895cc0 --- /dev/null +++ b/advisories/github-reviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json @@ -0,0 +1,164 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c533-c843-67h8", + "modified": "2024-05-15T20:52:03Z", + "published": "2022-02-12T00:00:47Z", + "aliases": [ + "CVE-2020-13669" + ], + "summary": "Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor", + "details": "Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.8.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.9.0" + }, + { + "fixed": "8.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.8.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.9.0" + }, + { + "fixed": "8.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13669" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2020-010" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-15T20:52:03Z", + "nvd_published_at": "2022-02-11T16:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/05/GHSA-gxxj-g9v8-w28p/GHSA-gxxj-g9v8-w28p.json b/advisories/github-reviewed/2024/05/GHSA-gxxj-g9v8-w28p/GHSA-gxxj-g9v8-w28p.json new file mode 100644 index 00000000000..24bbe1fc647 --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-gxxj-g9v8-w28p/GHSA-gxxj-g9v8-w28p.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gxxj-g9v8-w28p", + "modified": "2024-05-15T20:50:24Z", + "published": "2024-05-15T20:50:24Z", + "aliases": [ + + ], + "summary": "Drupal core Arbitrary PHP code execution", + "details": "The Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:\nCVE-2020-28948\nCVE-2020-28949\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.\n\nTo mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.75" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.9.0" + }, + { + "fixed": "8.9.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-11-25.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2020-013" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-05-15T20:50:24Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/05/GHSA-r67r-42wx-c8r7/GHSA-r67r-42wx-c8r7.json b/advisories/github-reviewed/2024/05/GHSA-r67r-42wx-c8r7/GHSA-r67r-42wx-c8r7.json new file mode 100644 index 00000000000..42ed8d37f90 --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-r67r-42wx-c8r7/GHSA-r67r-42wx-c8r7.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r67r-42wx-c8r7", + "modified": "2024-05-15T20:52:44Z", + "published": "2024-05-15T20:52:43Z", + "aliases": [ + + ], + "summary": "Drupal External URL injection through URL aliases leading to Open Redirect", + "details": "The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content.\nIn certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.60" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.5.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.6.0" + }, + { + "fixed": "8.6.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-2.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/drupal" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-006" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-601" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-15T20:52:43Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/05/GHSA-vfgc-c76h-mwh4/GHSA-vfgc-c76h-mwh4.json b/advisories/github-reviewed/2024/05/GHSA-vfgc-c76h-mwh4/GHSA-vfgc-c76h-mwh4.json new file mode 100644 index 00000000000..57f044cc781 --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-vfgc-c76h-mwh4/GHSA-vfgc-c76h-mwh4.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vfgc-c76h-mwh4", + "modified": "2024-05-15T20:51:25Z", + "published": "2024-05-15T20:51:25Z", + "aliases": [ + + ], + "summary": "Drupal core Cross-Site Scripting (XSS) vulnerabilities", + "details": "The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.\n\nVulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.9.18" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.1.0" + }, + { + "fixed": "9.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2021-05-26.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2021-005" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-15T20:51:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json b/advisories/unreviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json deleted file mode 100644 index 43b8eafd9ab..00000000000 --- a/advisories/unreviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3m36-mjwj-352c", - "modified": "2022-04-13T00:01:08Z", - "published": "2022-02-12T00:00:47Z", - "aliases": [ - "CVE-2020-13672" - ], - "details": "Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13672" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2021-002" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-02-11T16:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json b/advisories/unreviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json deleted file mode 100644 index 4e899eb099a..00000000000 --- a/advisories/unreviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-c533-c843-67h8", - "modified": "2022-02-18T00:00:44Z", - "published": "2022-02-12T00:00:47Z", - "aliases": [ - "CVE-2020-13669" - ], - "details": "Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13669" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2020-010" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-02-11T16:15:00Z" - } -} \ No newline at end of file