From 2160d9620d6c6f254ba2004756e3d1e8d98eaa79 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 6 Aug 2024 18:53:20 +0000
Subject: [PATCH] Publish GHSA-wv28-7fpw-fj49

---
 .../03/GHSA-wv28-7fpw-fj49/GHSA-wv28-7fpw-fj49.json | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2024/03/GHSA-wv28-7fpw-fj49/GHSA-wv28-7fpw-fj49.json b/advisories/github-reviewed/2024/03/GHSA-wv28-7fpw-fj49/GHSA-wv28-7fpw-fj49.json
index 953604e27e4..7fdf293cb65 100644
--- a/advisories/github-reviewed/2024/03/GHSA-wv28-7fpw-fj49/GHSA-wv28-7fpw-fj49.json
+++ b/advisories/github-reviewed/2024/03/GHSA-wv28-7fpw-fj49/GHSA-wv28-7fpw-fj49.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wv28-7fpw-fj49",
-  "modified": "2024-03-27T21:59:55Z",
+  "modified": "2024-08-06T18:51:02Z",
   "published": "2024-03-27T06:30:33Z",
   "aliases": [
     "CVE-2024-28335"
@@ -9,7 +9,14 @@
   "summary": "Lektor does not sanitize database path traversal",
   "details": "Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the \"lektor server\" command.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -93,7 +100,7 @@
     "cwe_ids": [
       "CWE-22"
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-27T21:59:55Z",
     "nvd_published_at": "2024-03-27T06:15:19Z"