From 3cb316d757b77951dc7a8490c89da24f2a1ce33f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 25 Apr 2024 22:18:17 +0000 Subject: [PATCH] Publish Advisories GHSA-9qmh-276g-x5pj GHSA-33f9-j839-rf8h GHSA-584h-jhxh-pxp2 GHSA-jccv-3h4x-35mv --- .../GHSA-9qmh-276g-x5pj.json | 4 +- .../GHSA-33f9-j839-rf8h.json | 4 +- .../GHSA-584h-jhxh-pxp2.json | 34 +++++++++++++---- .../GHSA-jccv-3h4x-35mv.json | 37 ++++++++++++++++--- 4 files changed, 63 insertions(+), 16 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json (56%) diff --git a/advisories/github-reviewed/2021/01/GHSA-9qmh-276g-x5pj/GHSA-9qmh-276g-x5pj.json b/advisories/github-reviewed/2021/01/GHSA-9qmh-276g-x5pj/GHSA-9qmh-276g-x5pj.json index 13d4e32587c..d95c77c41c7 100644 --- a/advisories/github-reviewed/2021/01/GHSA-9qmh-276g-x5pj/GHSA-9qmh-276g-x5pj.json +++ b/advisories/github-reviewed/2021/01/GHSA-9qmh-276g-x5pj/GHSA-9qmh-276g-x5pj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9qmh-276g-x5pj", - "modified": "2023-09-11T22:48:36Z", + "modified": "2024-04-25T22:17:51Z", "published": "2021-01-20T21:27:56Z", "aliases": [ "CVE-2020-28477" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "7.0.0" }, { "fixed": "8.0.1" diff --git a/advisories/github-reviewed/2021/09/GHSA-33f9-j839-rf8h/GHSA-33f9-j839-rf8h.json b/advisories/github-reviewed/2021/09/GHSA-33f9-j839-rf8h/GHSA-33f9-j839-rf8h.json index a28744b8ca1..4e01059b0d2 100644 --- a/advisories/github-reviewed/2021/09/GHSA-33f9-j839-rf8h/GHSA-33f9-j839-rf8h.json +++ b/advisories/github-reviewed/2021/09/GHSA-33f9-j839-rf8h/GHSA-33f9-j839-rf8h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-33f9-j839-rf8h", - "modified": "2023-09-11T22:29:53Z", + "modified": "2024-04-25T22:16:53Z", "published": "2021-09-02T17:17:37Z", "aliases": [ "CVE-2021-23436" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "7.0.0" }, { "fixed": "9.0.6" diff --git a/advisories/unreviewed/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json b/advisories/github-reviewed/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json rename to advisories/github-reviewed/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json index 7c8b52fe325..dc1b1047466 100644 --- a/advisories/unreviewed/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json +++ b/advisories/github-reviewed/2022/05/GHSA-584h-jhxh-pxp2/GHSA-584h-jhxh-pxp2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-584h-jhxh-pxp2", - "modified": "2022-05-13T01:11:16Z", + "modified": "2024-04-25T22:17:33Z", "published": "2022-05-13T01:11:16Z", "aliases": [ "CVE-2018-14009" ], + "summary": "Codiad remote code execution vulnerability", "details": "Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "codiad/codiad" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.8.4" + } + ] + } + ] + } ], "references": [ { @@ -22,8 +41,8 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14009" }, { - "type": "WEB", - "url": "https://github.com/Codiad/Codiad/issues/1078" + "type": "PACKAGE", + "url": "https://github.com/Codiad/Codiad" }, { "type": "WEB", @@ -36,11 +55,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-74" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T22:17:33Z", "nvd_published_at": "2018-07-12T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json b/advisories/github-reviewed/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json rename to advisories/github-reviewed/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json index e903cdadcd1..c0ddce84cd3 100644 --- a/advisories/unreviewed/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json +++ b/advisories/github-reviewed/2022/05/GHSA-jccv-3h4x-35mv/GHSA-jccv-3h4x-35mv.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-jccv-3h4x-35mv", - "modified": "2022-05-13T01:42:17Z", + "modified": "2024-04-25T22:17:10Z", "published": "2022-05-13T01:42:17Z", "aliases": [ "CVE-2017-11366" ], - "details": "components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.", + "summary": "Codiad Vulnerable to Shell Command Injection", + "details": "components/filemanager/class.filemanager.php in Codiad before 2.8.3 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by `search_file_type`.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "codiad/codiad" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.3" + } + ] + } + ] + } ], "references": [ { @@ -33,6 +52,14 @@ "type": "WEB", "url": "https://github.com/Codiad/Codiad/pull/1013/commits/b3645b4c6718cef6de7003f41aafe7bfcc0395d1" }, + { + "type": "WEB", + "url": "https://github.com/Codiad/Codiad/commit/ca5089eeba42d16ce3a7f86be628ac7750780111" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Codiad/Codiad" + }, { "type": "WEB", "url": "http://www.jianshu.com/p/41ac7ac2a7af" @@ -43,8 +70,8 @@ "CWE-78" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T22:17:10Z", "nvd_published_at": "2017-08-21T01:29:00Z" } } \ No newline at end of file