diff --git a/advisories/github-reviewed/2020/10/GHSA-4p55-xj37-fx7g/GHSA-4p55-xj37-fx7g.json b/advisories/github-reviewed/2020/10/GHSA-4p55-xj37-fx7g/GHSA-4p55-xj37-fx7g.json index 13677197a2e..c00e70ac858 100644 --- a/advisories/github-reviewed/2020/10/GHSA-4p55-xj37-fx7g/GHSA-4p55-xj37-fx7g.json +++ b/advisories/github-reviewed/2020/10/GHSA-4p55-xj37-fx7g/GHSA-4p55-xj37-fx7g.json @@ -1,15 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-4p55-xj37-fx7g", - "modified": "2020-10-29T16:25:47Z", + "modified": "2023-09-13T19:30:47Z", "published": "2020-10-29T18:29:31Z", "aliases": [ "CVE-2020-27665" ], "summary": "Improper Authorization in Strapi", - "details": "In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.", + "details": "In Strapi before 3.2.5, there is no `admin::hasPermissions` restriction for CTB (aka content-type-builder) routes.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } ], "affected": [ { @@ -17,6 +20,11 @@ "ecosystem": "npm", "name": "strapi-plugin-content-type-builder" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -58,7 +66,7 @@ "cwe_ids": [ "CWE-276" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-10-29T16:25:47Z", "nvd_published_at": null