From 34a06cff68bf34388e7061de2a0d2f42e56603bf Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 1 Mar 2024 15:01:40 +0000 Subject: [PATCH] Publish Advisories GHSA-4m5p-5w5w-3jcf GHSA-mw2c-vx6j-mg76 --- .../2022/10/GHSA-4m5p-5w5w-3jcf/GHSA-4m5p-5w5w-3jcf.json | 4 ++-- .../2024/02/GHSA-mw2c-vx6j-mg76/GHSA-mw2c-vx6j-mg76.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/advisories/github-reviewed/2022/10/GHSA-4m5p-5w5w-3jcf/GHSA-4m5p-5w5w-3jcf.json b/advisories/github-reviewed/2022/10/GHSA-4m5p-5w5w-3jcf/GHSA-4m5p-5w5w-3jcf.json index 72ed3de6d8a..0c9aadd6bae 100644 --- a/advisories/github-reviewed/2022/10/GHSA-4m5p-5w5w-3jcf/GHSA-4m5p-5w5w-3jcf.json +++ b/advisories/github-reviewed/2022/10/GHSA-4m5p-5w5w-3jcf/GHSA-4m5p-5w5w-3jcf.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-4m5p-5w5w-3jcf", - "modified": "2022-10-12T20:13:46Z", + "modified": "2024-03-01T15:01:10Z", "published": "2022-10-12T20:13:46Z", "aliases": [ ], "summary": "com.enonic.xp:lib-auth vulnerable to Session Fixation", - "details": "### Impact\nAll id-providers using lib-auth `login` method. lib-auth should invalidate old session after login and replicate session attributes in a new one, however this is not the behavior in affected versions.\n\n### Workarounds\nDon't use lib-auth for `login`. \nJava API uses low-level structures and allows to invalidate previous session before auth-info is added.\n\n### References\n\nhttps://github.com/enonic/xp/issues/9253", + "details": "### Impact\nAll id-providers using lib-auth `login` method.\n\n### Patches\nhttps://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff\nhttps://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842\nhttps://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4\n\n### Workarounds\nDon't use lib-auth for `login`. \nJava API uses low-level structures and allows to invalidate previous session before auth-info is added.\n\n### References\n\nhttps://github.com/enonic/xp/issues/9253", "severity": [ ], diff --git a/advisories/github-reviewed/2024/02/GHSA-mw2c-vx6j-mg76/GHSA-mw2c-vx6j-mg76.json b/advisories/github-reviewed/2024/02/GHSA-mw2c-vx6j-mg76/GHSA-mw2c-vx6j-mg76.json index 3b92cd35166..35f698d780f 100644 --- a/advisories/github-reviewed/2024/02/GHSA-mw2c-vx6j-mg76/GHSA-mw2c-vx6j-mg76.json +++ b/advisories/github-reviewed/2024/02/GHSA-mw2c-vx6j-mg76/GHSA-mw2c-vx6j-mg76.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-mw2c-vx6j-mg76", - "modified": "2024-02-15T14:57:18Z", + "modified": "2024-03-01T15:00:32Z", "published": "2024-02-07T17:31:34Z", "aliases": [ "CVE-2024-24816" ], "summary": "CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature", - "details": "### Affected packages\nThe vulnerability has been discovered in the samples that use the [preview](https://ckeditor.com/cke4/addon/preview) feature:\n\n* `samples/old/**/*.html`\n* `plugins/[plugin name]/samples/**/*.html`\n\nAll integrators that use these samples in the production code can be affected. \n\n### Impact\n\nA potential vulnerability has been discovered in one of CKEditor's 4 samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the misconfigured [preview feature](https://ckeditor.com/cke4/addon/preview). It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 4.24.0-lts.\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.\n\n### Acknowledgements\nThe CKEditor 4 team would like to thank Marcin Wyczechowski & Michał Majchrowicz AFINE Team for recognizing and reporting this vulnerability.", + "details": "### Affected packages\nThe vulnerability has been discovered in the samples that use the [preview](https://ckeditor.com/cke4/addon/preview) feature:\n\n* `samples/old/**/*.html`\n* `plugins/[plugin name]/samples/**/*.html`\n\nAll integrators that use these samples in the production code can be affected.\n\n### Impact\n\nA potential vulnerability has been discovered in one of CKEditor's 4 samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the misconfigured [preview feature](https://ckeditor.com/cke4/addon/preview). It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 4.24.0-lts.\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.\n\n### Acknowledgements\nThe CKEditor 4 team would like to thank [Marcin Wyczechowski](https://www.linkedin.com/in/marcin-wyczechowski-0a823795/) & [Michał Majchrowicz](https://www.linkedin.com/in/micha%C5%82-majchrowicz-mwsc/) [AFINE Team](https://afine.com/) for recognizing and reporting this vulnerability.", "severity": [ { "type": "CVSS_V3",