diff --git a/advisories/unreviewed/2025/06/GHSA-5gr5-vmmr-82g6/GHSA-5gr5-vmmr-82g6.json b/advisories/github-reviewed/2025/06/GHSA-5gr5-vmmr-82g6/GHSA-5gr5-vmmr-82g6.json similarity index 59% rename from advisories/unreviewed/2025/06/GHSA-5gr5-vmmr-82g6/GHSA-5gr5-vmmr-82g6.json rename to advisories/github-reviewed/2025/06/GHSA-5gr5-vmmr-82g6/GHSA-5gr5-vmmr-82g6.json index 908739a7dc9..6b245fc16ff 100644 --- a/advisories/unreviewed/2025/06/GHSA-5gr5-vmmr-82g6/GHSA-5gr5-vmmr-82g6.json +++ b/advisories/github-reviewed/2025/06/GHSA-5gr5-vmmr-82g6/GHSA-5gr5-vmmr-82g6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5gr5-vmmr-82g6", - "modified": "2025-06-03T21:30:36Z", + "modified": "2025-06-05T22:03:42Z", "published": "2025-06-03T15:31:26Z", "aliases": [ "CVE-2025-45855" ], + "summary": "Erupt Unrestricted Upload of File with Dangerous Type vulnerability", "details": "An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "xyz.erupt:erupt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.12.19" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -24,12 +45,12 @@ "url": "https://gist.github.com/Cafe-Tea/b72d442be434e1dafe7810c938892b06" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/erupts/erupt" }, { "type": "WEB", - "url": "https://www.erupt.xyz/#%21" + "url": "https://www.erupt.xyz/#!" } ], "database_specific": { @@ -37,8 +58,8 @@ "CWE-434" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-06-05T22:03:42Z", "nvd_published_at": "2025-06-03T14:15:48Z" } } \ No newline at end of file