From 3af7abe288f544f40ce808fa8ebeb652fe044a3b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 25 Sep 2024 19:01:47 +0000
Subject: [PATCH] Publish GHSA-x8h2-255q-jg4x

---
 .../GHSA-x8h2-255q-jg4x.json                  | 52 +++++++++++++++++--
 1 file changed, 47 insertions(+), 5 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json (61%)

diff --git a/advisories/unreviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json b/advisories/github-reviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json
similarity index 61%
rename from advisories/unreviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json
rename to advisories/github-reviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json
index 72932401fe3..1ae1a1f5919 100644
--- a/advisories/unreviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json
+++ b/advisories/github-reviewed/2024/09/GHSA-x8h2-255q-jg4x/GHSA-x8h2-255q-jg4x.json
@@ -1,12 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x8h2-255q-jg4x",
-  "modified": "2024-09-25T03:30:36Z",
+  "modified": "2024-09-25T19:00:22Z",
   "published": "2024-09-25T03:30:36Z",
   "aliases": [
     "CVE-2024-7398"
   ],
-  "details": "Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 1.8 with vector  CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N . Thank you, Yusuke Uchida for reporting.",
+  "summary": "Cross site scripting in Concrete CMS",
+  "details": "Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. ",
   "severity": [
     {
       "type": "CVSS_V4",
@@ -14,7 +15,44 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "concrete5/concrete5"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.3.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "concrete5/concrete5"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "8.5.19"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -40,6 +78,10 @@
     {
       "type": "WEB",
       "url": "https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/concretecms/concretecms"
     }
   ],
   "database_specific": {
@@ -47,8 +89,8 @@
       "CWE-79"
     ],
     "severity": "LOW",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-09-25T19:00:22Z",
     "nvd_published_at": "2024-09-25T01:15:45Z"
   }
 }
\ No newline at end of file