diff --git a/advisories/unreviewed/2022/05/GHSA-4m6v-x9fj-847j/GHSA-4m6v-x9fj-847j.json b/advisories/github-reviewed/2022/05/GHSA-4m6v-x9fj-847j/GHSA-4m6v-x9fj-847j.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-4m6v-x9fj-847j/GHSA-4m6v-x9fj-847j.json rename to advisories/github-reviewed/2022/05/GHSA-4m6v-x9fj-847j/GHSA-4m6v-x9fj-847j.json index cc00e8075bb..5fa2041dc99 100644 --- a/advisories/unreviewed/2022/05/GHSA-4m6v-x9fj-847j/GHSA-4m6v-x9fj-847j.json +++ b/advisories/github-reviewed/2022/05/GHSA-4m6v-x9fj-847j/GHSA-4m6v-x9fj-847j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4m6v-x9fj-847j", - "modified": "2022-05-14T03:22:57Z", + "modified": "2024-04-24T17:30:14Z", "published": "2022-05-14T03:22:57Z", "aliases": [ "CVE-2017-7298" ], + "summary": "Moodle Cross-site Scripting in the Course summary filter of the Add a new course", "details": "In Moodle 3.2.2+, there is XSS in the Course summary filter of the \"Add a new course\" page, as demonstrated by a crafted attribute of an SVG element.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "last_affected": "3.2.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7298" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "http://www.daimacn.com/index.php/post/12.html" @@ -39,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:30:14Z", "nvd_published_at": "2017-03-29T05:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-98mf-mqw9-9q8q/GHSA-98mf-mqw9-9q8q.json b/advisories/github-reviewed/2022/05/GHSA-98mf-mqw9-9q8q/GHSA-98mf-mqw9-9q8q.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-98mf-mqw9-9q8q/GHSA-98mf-mqw9-9q8q.json rename to advisories/github-reviewed/2022/05/GHSA-98mf-mqw9-9q8q/GHSA-98mf-mqw9-9q8q.json index d0262721e6b..5afdda37963 100644 --- a/advisories/unreviewed/2022/05/GHSA-98mf-mqw9-9q8q/GHSA-98mf-mqw9-9q8q.json +++ b/advisories/github-reviewed/2022/05/GHSA-98mf-mqw9-9q8q/GHSA-98mf-mqw9-9q8q.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-98mf-mqw9-9q8q", - "modified": "2022-05-17T02:30:18Z", + "modified": "2024-04-24T17:30:27Z", "published": "2022-05-17T02:30:18Z", "aliases": [ "CVE-2017-2643" ], + "summary": "Moodle Global search displays user names for unauthenticated users", "details": "In Moodle 3.2.x, global search displays user names for unauthenticated users.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2643" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=349420" @@ -39,8 +62,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:30:27Z", "nvd_published_at": "2017-03-26T18:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-9cg4-4f87-jhm3/GHSA-9cg4-4f87-jhm3.json b/advisories/github-reviewed/2022/05/GHSA-9cg4-4f87-jhm3/GHSA-9cg4-4f87-jhm3.json new file mode 100644 index 00000000000..4d683d94516 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-9cg4-4f87-jhm3/GHSA-9cg4-4f87-jhm3.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9cg4-4f87-jhm3", + "modified": "2024-04-24T17:30:20Z", + "published": "2022-05-17T02:30:18Z", + "aliases": [ + "CVE-2017-2645" + ], + "summary": "Moodle XSS in attachments to evidence of prior learning", + "details": "In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2645" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=349422" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/96982" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1038174" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:30:20Z", + "nvd_published_at": "2017-03-26T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/07/GHSA-243v-5pff-qqfj/GHSA-243v-5pff-qqfj.json b/advisories/github-reviewed/2022/07/GHSA-243v-5pff-qqfj/GHSA-243v-5pff-qqfj.json similarity index 56% rename from advisories/unreviewed/2022/07/GHSA-243v-5pff-qqfj/GHSA-243v-5pff-qqfj.json rename to advisories/github-reviewed/2022/07/GHSA-243v-5pff-qqfj/GHSA-243v-5pff-qqfj.json index 273630c6928..e50311cc360 100644 --- a/advisories/unreviewed/2022/07/GHSA-243v-5pff-qqfj/GHSA-243v-5pff-qqfj.json +++ b/advisories/github-reviewed/2022/07/GHSA-243v-5pff-qqfj/GHSA-243v-5pff-qqfj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-243v-5pff-qqfj", - "modified": "2022-08-02T00:00:24Z", + "modified": "2024-04-24T17:30:30Z", "published": "2022-07-26T00:00:29Z", "aliases": [ "CVE-2022-35652" ], + "summary": "Moodle Open redirect risk in mobile auto-login feature", "details": "An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.", "severity": [ { @@ -14,7 +15,63 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9" + }, + { + "fixed": "3.9.15" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +82,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2106276" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3" @@ -47,8 +108,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:30:30Z", "nvd_published_at": "2022-07-25T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/07/GHSA-62wh-m4jr-233r/GHSA-62wh-m4jr-233r.json b/advisories/github-reviewed/2022/07/GHSA-62wh-m4jr-233r/GHSA-62wh-m4jr-233r.json similarity index 58% rename from advisories/unreviewed/2022/07/GHSA-62wh-m4jr-233r/GHSA-62wh-m4jr-233r.json rename to advisories/github-reviewed/2022/07/GHSA-62wh-m4jr-233r/GHSA-62wh-m4jr-233r.json index fa76e2fe5a3..23350987664 100644 --- a/advisories/unreviewed/2022/07/GHSA-62wh-m4jr-233r/GHSA-62wh-m4jr-233r.json +++ b/advisories/github-reviewed/2022/07/GHSA-62wh-m4jr-233r/GHSA-62wh-m4jr-233r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-62wh-m4jr-233r", - "modified": "2022-07-29T00:00:18Z", + "modified": "2024-04-24T17:30:34Z", "published": "2022-07-26T00:00:30Z", "aliases": [ "CVE-2022-35653" ], + "summary": "Moodle LTI module reflected XSS risk", "details": "A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.", "severity": [ { @@ -14,7 +15,63 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9" + }, + { + "fixed": "3.9.15" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +82,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2106277" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3" @@ -47,8 +108,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:30:34Z", "nvd_published_at": "2022-07-25T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9cg4-4f87-jhm3/GHSA-9cg4-4f87-jhm3.json b/advisories/unreviewed/2022/05/GHSA-9cg4-4f87-jhm3/GHSA-9cg4-4f87-jhm3.json deleted file mode 100644 index f594ad5dc82..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-9cg4-4f87-jhm3/GHSA-9cg4-4f87-jhm3.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9cg4-4f87-jhm3", - "modified": "2022-05-17T02:30:18Z", - "published": "2022-05-17T02:30:18Z", - "aliases": [ - "CVE-2017-2645" - ], - "details": "In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2645" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=349422" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/96982" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1038174" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-03-26T18:59:00Z" - } -} \ No newline at end of file