diff --git a/advisories/unreviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json b/advisories/github-reviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json similarity index 61% rename from advisories/unreviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json rename to advisories/github-reviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json index 72932401fe3..1ae1a1f5919 100644 --- a/advisories/unreviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json +++ b/advisories/github-reviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x8h2-255q-jg4x", - "modified": "2024-09-25T03:30:36Z", + "modified": "2024-09-25T19:00:22Z", "published": "2024-09-25T03:30:36Z", "aliases": [ "CVE-2024-7398" ], - "details": "Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 1.8 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N . Thank you, Yusuke Uchida for reporting.", + "summary": "Cross site scripting in Concrete CMS", + "details": "Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. ", "severity": [ { "type": "CVSS_V4", @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.3.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.5.19" + } + ] + } + ] + } ], "references": [ { @@ -40,6 +78,10 @@ { "type": "WEB", "url": "https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" } ], "database_specific": { @@ -47,8 +89,8 @@ "CWE-79" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-25T19:00:22Z", "nvd_published_at": "2024-09-25T01:15:45Z" } } \ No newline at end of file