From 342ec835534fe7b63b4ab9ca038e2fda7fce1c43 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 30 Jan 2024 23:08:39 +0000
Subject: [PATCH] Publish Advisories

GHSA-4gh2-m88h-8cj8
GHSA-vrpg-c7c4-8mpx
---
 .../GHSA-4gh2-m88h-8cj8.json                  | 36 +++++++++++++----
 .../GHSA-vrpg-c7c4-8mpx.json                  | 39 +++++++++++++++----
 2 files changed, 61 insertions(+), 14 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json (57%)
 rename advisories/{unreviewed => github-reviewed}/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json (53%)

diff --git a/advisories/unreviewed/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json b/advisories/github-reviewed/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json
similarity index 57%
rename from advisories/unreviewed/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json
rename to advisories/github-reviewed/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json
index da8a5a0c61e..e0602c18b70 100644
--- a/advisories/unreviewed/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json
+++ b/advisories/github-reviewed/2023/09/GHSA-4gh2-m88h-8cj8/GHSA-4gh2-m88h-8cj8.json
@@ -1,17 +1,39 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4gh2-m88h-8cj8",
-  "modified": "2023-09-06T15:30:26Z",
+  "modified": "2024-01-30T23:07:24Z",
   "published": "2023-09-06T15:30:26Z",
   "aliases": [
     "CVE-2023-41939"
   ],
+  "summary": "Disabled permissions can be granted by Jenkins SSH2 Easy Plugin",
   "details": "Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:ssh2easy"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.6"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -29,11 +51,11 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-281"
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T23:07:24Z",
     "nvd_published_at": "2023-09-06T13:15:10Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json b/advisories/github-reviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json
similarity index 53%
rename from advisories/unreviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json
rename to advisories/github-reviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json
index 2ef88ffacfc..4a7429baece 100644
--- a/advisories/unreviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json
+++ b/advisories/github-reviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json
@@ -1,17 +1,42 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vrpg-c7c4-8mpx",
-  "modified": "2023-09-06T15:30:26Z",
+  "modified": "2024-01-30T23:07:57Z",
   "published": "2023-09-06T15:30:26Z",
   "aliases": [
     "CVE-2023-41937"
   ],
+  "summary": "SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials",
   "details": "Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "io.jenkins.plugins:bitbucket-push-and-pull-request"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.8.4"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.8.3"
+      }
+    }
   ],
   "references": [
     {
@@ -29,11 +54,11 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-918"
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T23:07:57Z",
     "nvd_published_at": "2023-09-06T13:15:10Z"
   }
 }
\ No newline at end of file