From 317831623e78ecb16e3e734deb1615869bf65596 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 3 Jan 2024 13:31:52 +0000
Subject: [PATCH] Publish Advisories

GHSA-6954-h5c8-m29f
GHSA-vp68-fm96-7v79
---
 .../GHSA-6954-h5c8-m29f/GHSA-6954-h5c8-m29f.json  | 15 +++++++++++----
 .../GHSA-vp68-fm96-7v79/GHSA-vp68-fm96-7v79.json  |  8 ++++++--
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/advisories/github-reviewed/2022/07/GHSA-6954-h5c8-m29f/GHSA-6954-h5c8-m29f.json b/advisories/github-reviewed/2022/07/GHSA-6954-h5c8-m29f/GHSA-6954-h5c8-m29f.json
index e3942ee196e..dbe28437c5f 100644
--- a/advisories/github-reviewed/2022/07/GHSA-6954-h5c8-m29f/GHSA-6954-h5c8-m29f.json
+++ b/advisories/github-reviewed/2022/07/GHSA-6954-h5c8-m29f/GHSA-6954-h5c8-m29f.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6954-h5c8-m29f",
-  "modified": "2023-10-27T20:51:25Z",
+  "modified": "2024-01-03T13:30:13Z",
   "published": "2022-07-28T00:00:42Z",
   "aliases": [
     "CVE-2022-36922"
   ],
   "summary": "Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting",
-  "details": "Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page.\n\nThis results in a reflected cross-site scripting (XSS) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
+  "details": "Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page.\n\nThis results in a reflected cross-site scripting (XSS) vulnerability.\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -28,11 +28,14 @@
               "introduced": "0"
             },
             {
-              "last_affected": "370.v62a5f618cd3a"
+              "fixed": "387.v938a"
             }
           ]
         }
-      ]
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 370.v62a5f618cd3a"
+      }
     }
   ],
   "references": [
@@ -40,6 +43,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36922"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/lucene-search-plugin/commit/5f9fd00d83a5a73a7b9579e8139b3db3a9065ed2"
+    },
     {
       "type": "WEB",
       "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2812"
diff --git a/advisories/github-reviewed/2022/07/GHSA-vp68-fm96-7v79/GHSA-vp68-fm96-7v79.json b/advisories/github-reviewed/2022/07/GHSA-vp68-fm96-7v79/GHSA-vp68-fm96-7v79.json
index 0341ab0e62b..994b00a058c 100644
--- a/advisories/github-reviewed/2022/07/GHSA-vp68-fm96-7v79/GHSA-vp68-fm96-7v79.json
+++ b/advisories/github-reviewed/2022/07/GHSA-vp68-fm96-7v79/GHSA-vp68-fm96-7v79.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vp68-fm96-7v79",
-  "modified": "2023-10-27T20:48:04Z",
+  "modified": "2024-01-03T13:31:24Z",
   "published": "2022-07-28T00:00:42Z",
   "aliases": [
     "CVE-2022-36915"
   ],
   "summary": "Jenkins Android Signing Plugin allows attackers to check whether attacker-specified file patterns match workspace contents",
-  "details": "Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.\n\nAs of publication of this advisory, there is no fix.",
+  "details": "Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -40,6 +40,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36915"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/android-signing-plugin/commit/33162c65c9f52ca5fa85609bdb652a5d1feda95b"
+    },
     {
       "type": "WEB",
       "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2404"