From 2c1988578fe5d321179063a6982d5c7602c4b51b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 25 Apr 2024 21:21:53 +0000 Subject: [PATCH] Publish Advisories GHSA-hpj2-4hfj-g233 GHSA-j9wr-mj69-cqmv GHSA-p29c-jpgj-v57r GHSA-hpj2-4hfj-g233 --- .../GHSA-hpj2-4hfj-g233.json | 65 +++++++++++++++++++ .../GHSA-j9wr-mj69-cqmv.json | 38 +++++++++-- .../GHSA-p29c-jpgj-v57r.json | 41 ++++++++++-- .../GHSA-hpj2-4hfj-g233.json | 39 ----------- 4 files changed, 131 insertions(+), 52 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json (54%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json (60%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json diff --git a/advisories/github-reviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json b/advisories/github-reviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json new file mode 100644 index 00000000000..9b4f0a12758 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpj2-4hfj-g233", + "modified": "2024-04-25T21:20:27Z", + "published": "2022-05-24T17:10:47Z", + "aliases": [ + "CVE-2020-5203" + ], + "summary": "Fat-Free Framework arbitrary code execution", + "details": "In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., `$_REQUEST`, `$_GET`, or `$_POST`) to the framework's Clear method.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "bcosca/fatfree" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5203" + }, + { + "type": "WEB", + "url": "https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829" + }, + { + "type": "PACKAGE", + "url": "https://github.com/bcosca/fatfree" + }, + { + "type": "WEB", + "url": "https://github.com/bcosca/fatfree/releases" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:20:27Z", + "nvd_published_at": "2020-03-11T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json b/advisories/github-reviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json rename to advisories/github-reviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json index ecb13df50a2..fc885bece66 100644 --- a/advisories/unreviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json +++ b/advisories/github-reviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-j9wr-mj69-cqmv", - "modified": "2022-05-24T17:10:26Z", + "modified": "2024-04-25T21:21:27Z", "published": "2022-05-24T17:10:26Z", "aliases": [ "CVE-2020-10237" ], + "summary": "Froxlor Exposure of Sensitive Information to an Unauthorized Actor", "details": "An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.10.15" + } + ] + } + ] + } ], "references": [ { @@ -21,15 +43,19 @@ { "type": "WEB", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1165719" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" } ], "database_specific": { "cwe_ids": [ "CWE-200" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:21:27Z", "nvd_published_at": "2020-03-09T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json b/advisories/github-reviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json rename to advisories/github-reviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json index 4dcce58781c..680ed952816 100644 --- a/advisories/unreviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json +++ b/advisories/github-reviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-p29c-jpgj-v57r", - "modified": "2022-05-24T17:10:26Z", + "modified": "2024-04-25T21:21:25Z", "published": "2022-05-24T17:10:26Z", "aliases": [ "CVE-2020-10235" ], + "summary": "Froxlor arbitrary code execution via the database configuration options", "details": "An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.14" + } + ] + } + ] + } ], "references": [ { @@ -30,6 +52,10 @@ "type": "WEB", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1165721" }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" + }, { "type": "WEB", "url": "https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14" @@ -37,11 +63,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-78" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:21:25Z", "nvd_published_at": "2020-03-09T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json b/advisories/unreviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json deleted file mode 100644 index 7933f648151..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hpj2-4hfj-g233", - "modified": "2022-05-24T17:10:47Z", - "published": "2022-05-24T17:10:47Z", - "aliases": [ - "CVE-2020-5203" - ], - "details": "In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5203" - }, - { - "type": "WEB", - "url": "https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829" - }, - { - "type": "WEB", - "url": "https://github.com/bcosca/fatfree/releases" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-74" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-03-11T14:15:00Z" - } -} \ No newline at end of file