From 2b765b6e14e871b3f8fc9ba5a54d01af75482327 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 9 Aug 2024 18:25:32 +0000 Subject: [PATCH] Publish Advisories GHSA-f729-58x4-gqgf GHSA-pcwp-26pw-j98w --- .../GHSA-f729-58x4-gqgf.json | 68 ++++++++++++++++++ .../GHSA-pcwp-26pw-j98w.json | 72 +++++++++++++++++++ 2 files changed, 140 insertions(+) create mode 100644 advisories/github-reviewed/2024/08/GHSA-f729-58x4-gqgf/GHSA-f729-58x4-gqgf.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-pcwp-26pw-j98w/GHSA-pcwp-26pw-j98w.json diff --git a/advisories/github-reviewed/2024/08/GHSA-f729-58x4-gqgf/GHSA-f729-58x4-gqgf.json b/advisories/github-reviewed/2024/08/GHSA-f729-58x4-gqgf/GHSA-f729-58x4-gqgf.json new file mode 100644 index 00000000000..0b48a92d4fd --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-f729-58x4-gqgf/GHSA-f729-58x4-gqgf.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f729-58x4-gqgf", + "modified": "2024-08-09T18:24:07Z", + "published": "2024-08-09T18:24:07Z", + "aliases": [ + "CVE-2024-42469" + ], + "summary": "CometVisu Backend for openHAB affected by RCE through path traversal", + "details": "CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time this vulnerability can allow remote code execution by an attacker.\n\nThis vulnerability was discovered with the help of CodeQL's [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/java/java-path-injection/) query.\n\n## Impact\n\nThis issue may lead up to Remote Code Execution (RCE).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.openhab.ui.bundles:org.openhab.ui.cometvisu" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/openhab/openhab-webui/security/advisories/GHSA-f729-58x4-gqgf" + }, + { + "type": "WEB", + "url": "https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openhab/openhab-webui" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-08-09T18:24:07Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-pcwp-26pw-j98w/GHSA-pcwp-26pw-j98w.json b/advisories/github-reviewed/2024/08/GHSA-pcwp-26pw-j98w/GHSA-pcwp-26pw-j98w.json new file mode 100644 index 00000000000..6701bee6e8a --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-pcwp-26pw-j98w/GHSA-pcwp-26pw-j98w.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pcwp-26pw-j98w", + "modified": "2024-08-09T18:24:14Z", + "published": "2024-08-09T18:24:14Z", + "aliases": [ + "CVE-2024-42468" + ], + "summary": "CometVisu Backend for openHAB has a path traversal vulnerability", + "details": "openHAB's [CometVisuServlet](https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75) is susceptible to an unauthenticated path traversal vulnerability.\n\nLocal files on the server can be requested via HTTP GET on the CometVisuServlet.\n\nThis vulnerability was discovered with the help of CodeQL's [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/java/java-path-injection/) query.\n\n## Impact\n\nThis issue may lead to Information Disclosure.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.openhab.ui.bundles:org.openhab.ui.cometvisu" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w" + }, + { + "type": "WEB", + "url": "https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openhab/openhab-webui" + }, + { + "type": "WEB", + "url": "https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-09T18:24:14Z", + "nvd_published_at": null + } +} \ No newline at end of file