From 39e0cea85e21b48ca77d3bdf01664335261fee27 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 11 Mar 2025 21:35:40 +0000 Subject: [PATCH] Publish Advisories GHSA-59qh-fmm7-3g9q GHSA-qjpx-5m2p-5pgh --- .../GHSA-59qh-fmm7-3g9q.json | 65 +++++++++++++++++ .../GHSA-qjpx-5m2p-5pgh.json | 73 +++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100644 advisories/github-reviewed/2025/03/GHSA-59qh-fmm7-3g9q/GHSA-59qh-fmm7-3g9q.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-qjpx-5m2p-5pgh/GHSA-qjpx-5m2p-5pgh.json diff --git a/advisories/github-reviewed/2025/03/GHSA-59qh-fmm7-3g9q/GHSA-59qh-fmm7-3g9q.json b/advisories/github-reviewed/2025/03/GHSA-59qh-fmm7-3g9q/GHSA-59qh-fmm7-3g9q.json new file mode 100644 index 00000000000..43cb3f4b7e8 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-59qh-fmm7-3g9q/GHSA-59qh-fmm7-3g9q.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59qh-fmm7-3g9q", + "modified": "2025-03-11T21:32:43Z", + "published": "2025-03-11T21:32:43Z", + "aliases": [ + "CVE-2025-25302" + ], + "summary": "Rembg CORS misconfiguration", + "details": "Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "rembg" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.57" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25302" + }, + { + "type": "PACKAGE", + "url": "https://github.com/danielgatis/rembg" + }, + { + "type": "WEB", + "url": "https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-346" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-11T21:32:43Z", + "nvd_published_at": "2025-03-03T17:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-qjpx-5m2p-5pgh/GHSA-qjpx-5m2p-5pgh.json b/advisories/github-reviewed/2025/03/GHSA-qjpx-5m2p-5pgh/GHSA-qjpx-5m2p-5pgh.json new file mode 100644 index 00000000000..852dd286fb9 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-qjpx-5m2p-5pgh/GHSA-qjpx-5m2p-5pgh.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qjpx-5m2p-5pgh", + "modified": "2025-03-11T21:33:18Z", + "published": "2025-03-11T21:33:18Z", + "aliases": [ + "CVE-2025-27617" + ], + "summary": "Pimcore Vulnerable to SQL Injection in getRelationFilterCondition", + "details": "### Summary\nAuthenticated users can craft a filter string used to cause a SQL injection.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\nThis code does not look to sanitize inputs: https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47\n\nc.f. with https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "pimcore/pimcore" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.5.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-qjpx-5m2p-5pgh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27617" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/pimcore/commit/19a8520895484e68fd254773e32476565d91deea" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pimcore/pimcore" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-11T21:33:18Z", + "nvd_published_at": "2025-03-11T16:15:18Z" + } +} \ No newline at end of file