From 27788066b5bf40d6ebd3720622755ecf7f43c82e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 9 Jan 2025 23:14:41 +0000 Subject: [PATCH] Publish Advisories GHSA-g5x8-v2ch-gj2g GHSA-vprm-27pv-jp3w GHSA-x7m9-mv49-fv73 GHSA-x7m9-mv49-fv73 --- .../GHSA-g5x8-v2ch-gj2g.json | 46 +++++++++-- .../GHSA-vprm-27pv-jp3w.json | 46 +++++++++-- .../GHSA-x7m9-mv49-fv73.json | 77 +++++++++++++++++++ .../GHSA-x7m9-mv49-fv73.json | 37 --------- 4 files changed, 155 insertions(+), 51 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json (52%) rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json (50%) create mode 100644 advisories/github-reviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json diff --git a/advisories/unreviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json b/advisories/github-reviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json similarity index 52% rename from advisories/unreviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json rename to advisories/github-reviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json index f47a04bcdd9..71dae1ff6c6 100644 --- a/advisories/unreviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json +++ b/advisories/github-reviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-g5x8-v2ch-gj2g", - "modified": "2025-01-09T21:31:32Z", + "modified": "2025-01-09T23:13:14Z", "published": "2025-01-09T21:31:32Z", "aliases": [ "CVE-2024-55224" ], + "summary": "Vaultwarden HTML injection vulnerability", "details": "An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "vaultwarden" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.32.5" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55224" }, + { + "type": "PACKAGE", + "url": "https://github.com/dani-garcia/vaultwarden" + }, { "type": "WEB", "url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4" @@ -28,10 +58,12 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-01-09T23:13:14Z", "nvd_published_at": "2025-01-09T21:15:29Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json b/advisories/github-reviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json similarity index 50% rename from advisories/unreviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json rename to advisories/github-reviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json index 0f7e9d4f9f3..056787ea5e6 100644 --- a/advisories/unreviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json +++ b/advisories/github-reviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-vprm-27pv-jp3w", - "modified": "2025-01-09T21:31:32Z", + "modified": "2025-01-09T23:14:10Z", "published": "2025-01-09T21:31:32Z", "aliases": [ "CVE-2024-55226" ], + "summary": "Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability", "details": "Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "vaultwarden" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.32.5" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55226" }, + { + "type": "PACKAGE", + "url": "https://github.com/dani-garcia/vaultwarden" + }, { "type": "WEB", "url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4" @@ -28,10 +58,12 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-01-09T23:14:10Z", "nvd_published_at": "2025-01-09T21:15:29Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json b/advisories/github-reviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json new file mode 100644 index 00000000000..7056b471b36 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x7m9-mv49-fv73", + "modified": "2025-01-09T23:13:58Z", + "published": "2025-01-09T21:31:32Z", + "aliases": [ + "CVE-2024-55225" + ], + "summary": "Vaultwarden vulnerable to user impersonation", + "details": "An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "vaultwarden" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.32.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55225" + }, + { + "type": "WEB", + "url": "https://github.com/dani-garcia/vaultwarden/commit/20d9e885bfcd7df7828d92c6e59ed5fe7b40a879" + }, + { + "type": "WEB", + "url": "https://github.com/dani-garcia/vaultwarden/commit/37c14c3c69b244ec50f5c62b4c9260171607c1d8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dani-garcia/vaultwarden" + }, + { + "type": "WEB", + "url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4" + }, + { + "type": "WEB", + "url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5" + }, + { + "type": "WEB", + "url": "https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-09T23:13:58Z", + "nvd_published_at": "2025-01-09T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json b/advisories/unreviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json deleted file mode 100644 index b2d48967b90..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x7m9-mv49-fv73", - "modified": "2025-01-09T21:31:32Z", - "published": "2025-01-09T21:31:32Z", - "aliases": [ - "CVE-2024-55225" - ], - "details": "An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55225" - }, - { - "type": "WEB", - "url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4" - }, - { - "type": "WEB", - "url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5" - }, - { - "type": "WEB", - "url": "https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-09T21:15:29Z" - } -} \ No newline at end of file