diff --git a/advisories/unreviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json b/advisories/github-reviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json similarity index 51% rename from advisories/unreviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json rename to advisories/github-reviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json index 1273ff7d22a..08a2e6c9470 100644 --- a/advisories/unreviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json +++ b/advisories/github-reviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-wfm3-gq9h-mrjm", - "modified": "2024-02-23T00:30:33Z", + "modified": "2024-02-23T17:45:23Z", "published": "2024-02-23T00:30:33Z", "aliases": [ "CVE-2022-25377" ], - "details": "The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)", + "summary": "Appwrite Directory Traversal vulnerability", + "details": "The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, `APP_STORAGE_CERTIFICATES/.well-known/acme-challenge` must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "appwrite/server-ce" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.0" + }, + { + "fixed": "0.12.2" + } + ] + } + ] + } ], "references": [ { @@ -22,10 +41,18 @@ "type": "WEB", "url": "https://github.com/appwrite/appwrite/pull/2780" }, + { + "type": "WEB", + "url": "https://github.com/appwrite/appwrite/commit/892f6fa4ba0d44e2435ffad1a84542400cfb7a9b" + }, { "type": "WEB", "url": "https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1" }, + { + "type": "PACKAGE", + "url": "https://github.com/appwrite/appwrite" + }, { "type": "WEB", "url": "https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539" @@ -37,11 +64,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-23T17:45:23Z", "nvd_published_at": "2024-02-22T22:15:47Z" } } \ No newline at end of file