netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6p2q-8qfq-wq7x
GHSA-g26j-5385-hhw3
GHSA-w73r-8mm4-cfvf
GHSA-6p2q-8qfq-wq7x
GHSA-w73r-8mm4-cfvf
This commit is contained in:
advisory-database[bot]
2024-09-13 19:30:34 +00:00
parent 1cf73cff39
commit 2e40d43668
5 changed files with 169 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/09/GHSA-6p2q-8qfq-wq7x/GHSA-6p2q-8qfq-wq7x.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6p2q-8qfq-wq7x",
"modified": "2024-09-13T19:29:12Z",
"published": "2024-09-13T18:31:48Z",
"aliases": [
"CVE-2024-6087"
],
"summary": "Lunary improper access control vulnerability",
"details": "An improper access control vulnerability exists in lunary-ai/lunary prior to commit 844e8855c7a713dc7371766dba4125de4007b1cf on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later use the token to reset the password of the target user, leading to full account takeover.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "lunary"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6087"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf"
},
{
"type": "PACKAGE",
"url": "https://github.com/lunary-ai/lunary"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/bd9f2301-11c7-4cbd-8d77-3e9225bd67e8"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-09-13T19:29:12Z",
"nvd_published_at": "2024-09-13T17:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-g26j-5385-hhw3/GHSA-g26j-5385-hhw3.json → advisories/github-reviewed/2024/09/GHSA-g26j-5385-hhw3/GHSA-g26j-5385-hhw3.json
+31 -4
View File
@@ -1,20 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g26j-5385-hhw3",
"modified": "2024-09-13T18:31:47Z",
"modified": "2024-09-13T19:29:08Z",
"published": "2024-09-13T18:31:47Z",
"aliases": [
"CVE-2024-6587"
],
"summary": "LiteLLM Server-Side Request Forgery (SSRF) vulnerability",
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "litellm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.44.8"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +48,10 @@
"type": "WEB",
"url": "https://github.com/berriai/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0"
},
{
"type": "PACKAGE",
"url": "https://github.com/berriai/litellm"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997"
@@ -35,8 +62,8 @@
"CWE-918"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-13T19:29:08Z",
"nvd_published_at": "2024-09-13T16:15:04Z"
}
}
advisories/github-reviewed/2024/09/GHSA-w73r-8mm4-cfvf/GHSA-w73r-8mm4-cfvf.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w73r-8mm4-cfvf",
"modified": "2024-09-13T19:29:14Z",
"published": "2024-09-13T18:31:48Z",
"aliases": [
"CVE-2024-6582"
],
"summary": "Lunary Improper Authentication vulnerability",
"details": "A broken access control vulnerability exists prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "lunary"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6582"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/1f043d8798ad87346dfe378eea723bff78ad7433"
},
{
"type": "PACKAGE",
"url": "https://github.com/lunary-ai/lunary"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/251d138c-3911-4a81-96e5-5a4ab59a0b59"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-09-13T19:29:14Z",
"nvd_published_at": "2024-09-13T17:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-6p2q-8qfq-wq7x/GHSA-6p2q-8qfq-wq7x.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6p2q-8qfq-wq7x",
"modified": "2024-09-13T18:31:48Z",
"published": "2024-09-13T18:31:48Z",
"aliases": [
"CVE-2024-6087"
],
"details": "An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later use the token to reset the password of the target user, leading to full account takeover.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6087"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/bd9f2301-11c7-4cbd-8d77-3e9225bd67e8"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-13T17:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-w73r-8mm4-cfvf/GHSA-w73r-8mm4-cfvf.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w73r-8mm4-cfvf",
"modified": "2024-09-13T18:31:48Z",
"published": "2024-09-13T18:31:48Z",
"aliases": [
"CVE-2024-6582"
],
"details": "A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6582"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/1f043d8798ad87346dfe378eea723bff78ad7433"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/251d138c-3911-4a81-96e5-5a4ab59a0b59"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-13T17:15:13Z"
}
}