From 31c7bd2e3d7d941bd29a040640f4c9dae88e03a4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 29 Apr 2025 20:21:22 +0000 Subject: [PATCH] Publish Advisories GHSA-36vv-q5jv-94cj GHSA-6chf-hhqf-749c GHSA-jh66-rjx8-8qqc GHSA-jwpx-6c4p-q4jq GHSA-qchr-8m24-7v66 GHSA-rhxm-r44m-4325 --- .../04/GHSA-36vv-q5jv-94cj/GHSA-36vv-q5jv-94cj.json | 6 +++++- .../04/GHSA-6chf-hhqf-749c/GHSA-6chf-hhqf-749c.json | 8 ++++++-- .../04/GHSA-jh66-rjx8-8qqc/GHSA-jh66-rjx8-8qqc.json | 8 ++++++-- .../04/GHSA-jwpx-6c4p-q4jq/GHSA-jwpx-6c4p-q4jq.json | 10 +++++++--- .../04/GHSA-qchr-8m24-7v66/GHSA-qchr-8m24-7v66.json | 8 ++++++-- .../04/GHSA-rhxm-r44m-4325/GHSA-rhxm-r44m-4325.json | 6 +++++- 6 files changed, 35 insertions(+), 11 deletions(-) diff --git a/advisories/github-reviewed/2025/04/GHSA-36vv-q5jv-94cj/GHSA-36vv-q5jv-94cj.json b/advisories/github-reviewed/2025/04/GHSA-36vv-q5jv-94cj/GHSA-36vv-q5jv-94cj.json index 3562729a62c..507df2052bd 100644 --- a/advisories/github-reviewed/2025/04/GHSA-36vv-q5jv-94cj/GHSA-36vv-q5jv-94cj.json +++ b/advisories/github-reviewed/2025/04/GHSA-36vv-q5jv-94cj/GHSA-36vv-q5jv-94cj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-36vv-q5jv-94cj", - "modified": "2025-04-02T17:10:12Z", + "modified": "2025-04-29T20:19:12Z", "published": "2025-04-01T00:30:34Z", "aliases": [ "CVE-2025-31682" @@ -9,6 +9,10 @@ "summary": "Drupal Google Tag Cross-Site Scripting (XSS) vulnerability", "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS). This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" diff --git a/advisories/github-reviewed/2025/04/GHSA-6chf-hhqf-749c/GHSA-6chf-hhqf-749c.json b/advisories/github-reviewed/2025/04/GHSA-6chf-hhqf-749c/GHSA-6chf-hhqf-749c.json index e939ad71901..48470a84881 100644 --- a/advisories/github-reviewed/2025/04/GHSA-6chf-hhqf-749c/GHSA-6chf-hhqf-749c.json +++ b/advisories/github-reviewed/2025/04/GHSA-6chf-hhqf-749c/GHSA-6chf-hhqf-749c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6chf-hhqf-749c", - "modified": "2025-04-02T17:10:48Z", + "modified": "2025-04-29T20:20:34Z", "published": "2025-04-01T00:30:34Z", "aliases": [ "CVE-2025-31684" @@ -9,9 +9,13 @@ "summary": "Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)", "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery. This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" } ], "affected": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-jh66-rjx8-8qqc/GHSA-jh66-rjx8-8qqc.json b/advisories/github-reviewed/2025/04/GHSA-jh66-rjx8-8qqc/GHSA-jh66-rjx8-8qqc.json index 24d06a86e40..457b664f0d2 100644 --- a/advisories/github-reviewed/2025/04/GHSA-jh66-rjx8-8qqc/GHSA-jh66-rjx8-8qqc.json +++ b/advisories/github-reviewed/2025/04/GHSA-jh66-rjx8-8qqc/GHSA-jh66-rjx8-8qqc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jh66-rjx8-8qqc", - "modified": "2025-04-02T17:06:49Z", + "modified": "2025-04-29T20:18:25Z", "published": "2025-04-01T00:30:34Z", "aliases": [ "CVE-2025-31680" @@ -9,9 +9,13 @@ "summary": "Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability", "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery. This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" } ], "affected": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-jwpx-6c4p-q4jq/GHSA-jwpx-6c4p-q4jq.json b/advisories/github-reviewed/2025/04/GHSA-jwpx-6c4p-q4jq/GHSA-jwpx-6c4p-q4jq.json index f9cae54e984..dd60918c093 100644 --- a/advisories/github-reviewed/2025/04/GHSA-jwpx-6c4p-q4jq/GHSA-jwpx-6c4p-q4jq.json +++ b/advisories/github-reviewed/2025/04/GHSA-jwpx-6c4p-q4jq/GHSA-jwpx-6c4p-q4jq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jwpx-6c4p-q4jq", - "modified": "2025-04-02T17:09:04Z", + "modified": "2025-04-29T20:18:54Z", "published": "2025-04-01T00:30:34Z", "aliases": [ "CVE-2025-31681" @@ -9,9 +9,13 @@ "summary": "Drupal Authenticator Login Missing Authorization vulnerability", "details": "Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing. This issue affects Authenticator Login: from 0.0.0 before 2.0.6.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" } ], "affected": [ @@ -53,7 +57,7 @@ "cwe_ids": [ "CWE-862" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-04-02T17:09:04Z", "nvd_published_at": "2025-03-31T22:15:20Z" diff --git a/advisories/github-reviewed/2025/04/GHSA-qchr-8m24-7v66/GHSA-qchr-8m24-7v66.json b/advisories/github-reviewed/2025/04/GHSA-qchr-8m24-7v66/GHSA-qchr-8m24-7v66.json index 8212d175d76..3bb27859660 100644 --- a/advisories/github-reviewed/2025/04/GHSA-qchr-8m24-7v66/GHSA-qchr-8m24-7v66.json +++ b/advisories/github-reviewed/2025/04/GHSA-qchr-8m24-7v66/GHSA-qchr-8m24-7v66.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qchr-8m24-7v66", - "modified": "2025-04-02T17:10:30Z", + "modified": "2025-04-29T20:19:48Z", "published": "2025-04-01T00:30:34Z", "aliases": [ "CVE-2025-31683" @@ -9,9 +9,13 @@ "summary": "Drupal Google Tag Cross-Site Request Forgery (CSRF)", "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery. This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-rhxm-r44m-4325/GHSA-rhxm-r44m-4325.json b/advisories/github-reviewed/2025/04/GHSA-rhxm-r44m-4325/GHSA-rhxm-r44m-4325.json index c338785441e..0b6f2346951 100644 --- a/advisories/github-reviewed/2025/04/GHSA-rhxm-r44m-4325/GHSA-rhxm-r44m-4325.json +++ b/advisories/github-reviewed/2025/04/GHSA-rhxm-r44m-4325/GHSA-rhxm-r44m-4325.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rhxm-r44m-4325", - "modified": "2025-04-02T17:07:23Z", + "modified": "2025-04-29T20:18:01Z", "published": "2025-04-01T00:30:34Z", "aliases": [ "CVE-2025-31679" @@ -9,6 +9,10 @@ "summary": "Drupal Ignition Cross-Site Scripting (XSS) vulnerability", "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS). This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"