From 24c7057543f80aa22e94b60be322b63bfa89551d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 18 Dec 2023 18:41:39 +0000 Subject: [PATCH] Publish Advisories GHSA-6r5w-jjr5-qvgr GHSA-7ccg-jm7j-4f8v GHSA-9qv8-7jfq-73j2 GHSA-q5cj-xf99-79m8 GHSA-wjr6-v4c7-8cv6 --- .../12/GHSA-6r5w-jjr5-qvgr/GHSA-6r5w-jjr5-qvgr.json | 10 +++++++--- .../12/GHSA-7ccg-jm7j-4f8v/GHSA-7ccg-jm7j-4f8v.json | 7 +++++-- .../12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json | 7 +++++-- .../12/GHSA-q5cj-xf99-79m8/GHSA-q5cj-xf99-79m8.json | 10 +++++++--- .../12/GHSA-wjr6-v4c7-8cv6/GHSA-wjr6-v4c7-8cv6.json | 7 +++++-- 5 files changed, 29 insertions(+), 12 deletions(-) diff --git a/advisories/github-reviewed/2023/12/GHSA-6r5w-jjr5-qvgr/GHSA-6r5w-jjr5-qvgr.json b/advisories/github-reviewed/2023/12/GHSA-6r5w-jjr5-qvgr/GHSA-6r5w-jjr5-qvgr.json index c89e95aff35..9272d8bc7bc 100644 --- a/advisories/github-reviewed/2023/12/GHSA-6r5w-jjr5-qvgr/GHSA-6r5w-jjr5-qvgr.json +++ b/advisories/github-reviewed/2023/12/GHSA-6r5w-jjr5-qvgr/GHSA-6r5w-jjr5-qvgr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6r5w-jjr5-qvgr", - "modified": "2023-12-13T19:34:24Z", + "modified": "2023-12-18T18:39:10Z", "published": "2023-12-13T18:31:04Z", "aliases": [ "CVE-2023-50770" @@ -9,7 +9,10 @@ "summary": "Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin ", "details": "Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -48,7 +51,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-312" + "CWE-312", + "CWE-522" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2023/12/GHSA-7ccg-jm7j-4f8v/GHSA-7ccg-jm7j-4f8v.json b/advisories/github-reviewed/2023/12/GHSA-7ccg-jm7j-4f8v/GHSA-7ccg-jm7j-4f8v.json index 4d2a6efcdcd..5723f944dd4 100644 --- a/advisories/github-reviewed/2023/12/GHSA-7ccg-jm7j-4f8v/GHSA-7ccg-jm7j-4f8v.json +++ b/advisories/github-reviewed/2023/12/GHSA-7ccg-jm7j-4f8v/GHSA-7ccg-jm7j-4f8v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7ccg-jm7j-4f8v", - "modified": "2023-12-13T19:32:28Z", + "modified": "2023-12-18T18:39:20Z", "published": "2023-12-13T18:31:04Z", "aliases": [ "CVE-2023-50774" @@ -9,7 +9,10 @@ "summary": "Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin", "details": "A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json b/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json index 973064eabe4..ba9b58f173b 100644 --- a/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json +++ b/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9qv8-7jfq-73j2", - "modified": "2023-12-13T23:14:25Z", + "modified": "2023-12-18T18:39:15Z", "published": "2023-12-13T18:31:04Z", "aliases": [ "CVE-2023-50771" @@ -9,7 +9,10 @@ "summary": "Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin ", "details": "Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2023/12/GHSA-q5cj-xf99-79m8/GHSA-q5cj-xf99-79m8.json b/advisories/github-reviewed/2023/12/GHSA-q5cj-xf99-79m8/GHSA-q5cj-xf99-79m8.json index 50b219c3f33..b783d393b3a 100644 --- a/advisories/github-reviewed/2023/12/GHSA-q5cj-xf99-79m8/GHSA-q5cj-xf99-79m8.json +++ b/advisories/github-reviewed/2023/12/GHSA-q5cj-xf99-79m8/GHSA-q5cj-xf99-79m8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q5cj-xf99-79m8", - "modified": "2023-12-13T19:44:18Z", + "modified": "2023-12-18T18:39:29Z", "published": "2023-12-13T18:31:04Z", "aliases": [ "CVE-2023-50773" @@ -9,7 +9,10 @@ "summary": "Displayed in plain text by Dingding JSON Pusher Plugin ", "details": "Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ { @@ -48,7 +51,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-312" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2023/12/GHSA-wjr6-v4c7-8cv6/GHSA-wjr6-v4c7-8cv6.json b/advisories/github-reviewed/2023/12/GHSA-wjr6-v4c7-8cv6/GHSA-wjr6-v4c7-8cv6.json index e236723a67f..25bbe69b3c4 100644 --- a/advisories/github-reviewed/2023/12/GHSA-wjr6-v4c7-8cv6/GHSA-wjr6-v4c7-8cv6.json +++ b/advisories/github-reviewed/2023/12/GHSA-wjr6-v4c7-8cv6/GHSA-wjr6-v4c7-8cv6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wjr6-v4c7-8cv6", - "modified": "2023-12-13T19:34:44Z", + "modified": "2023-12-18T18:39:24Z", "published": "2023-12-13T18:31:04Z", "aliases": [ "CVE-2023-50772" @@ -9,7 +9,10 @@ "summary": "Tokens stored in plain text by Dingding JSON Pusher Plugin ", "details": "Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ {