diff --git a/advisories/unreviewed/2025/05/GHSA-gv5r-9gxr-v74w/GHSA-gv5r-9gxr-v74w.json b/advisories/github-reviewed/2025/05/GHSA-gv5r-9gxr-v74w/GHSA-gv5r-9gxr-v74w.json similarity index 61% rename from advisories/unreviewed/2025/05/GHSA-gv5r-9gxr-v74w/GHSA-gv5r-9gxr-v74w.json rename to advisories/github-reviewed/2025/05/GHSA-gv5r-9gxr-v74w/GHSA-gv5r-9gxr-v74w.json index e7eca9a661c..0448c5d241a 100644 --- a/advisories/unreviewed/2025/05/GHSA-gv5r-9gxr-v74w/GHSA-gv5r-9gxr-v74w.json +++ b/advisories/github-reviewed/2025/05/GHSA-gv5r-9gxr-v74w/GHSA-gv5r-9gxr-v74w.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gv5r-9gxr-v74w", - "modified": "2025-05-14T15:31:37Z", + "modified": "2025-05-15T14:51:25Z", "published": "2025-05-13T18:30:53Z", "aliases": [ "CVE-2025-47204" ], + "summary": "Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data", "details": "An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "bootstrap-multiselect" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103" }, + { + "type": "PACKAGE", + "url": "https://github.com/davidstutz/bootstrap-multiselect" + }, { "type": "WEB", "url": "https://github.com/davidstutz/bootstrap-multiselect/releases" @@ -30,11 +55,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-352" + "CWE-352", + "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-05-15T14:51:25Z", "nvd_published_at": "2025-05-13T16:15:31Z" } } \ No newline at end of file