Publish Advisories

GHSA-4hwx-xcc5-2hfc GHSA-7524-3396-fqv3 GHSA-q7g5-jq6p-6wvx
2026-05-22 18:04:22 -07:00 · 2025-04-07 16:39:35 +00:00
parent a5b1668359
commit 45bd987048
3 changed files with 195 additions and 0 deletions
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4hwx-xcc5-2hfc",
+  "modified": "2025-04-07T16:38:52Z",
+  "published": "2025-04-07T16:38:52Z",
+  "aliases": [
+    "CVE-2025-31475"
+  ],
+  "summary": "tarteaucitron.js allows prototype pollution via custom text injection",
+  "details": "A vulnerability was identified in `tarteaucitron.js`, where the `addOrUpdate` function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Modify object prototypes, affecting core JavaScript behavior,\n- Cause application crashes or unexpected behavior,\n- Potentially introduce further security vulnerabilities depending on the application's architecture.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b\nThe issue was resolved by ensuring that user-controlled inputs cannot modify JavaScript object prototypes.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "tarteaucitronjs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.20.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31475"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/AmauriC/tarteaucitron.js"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1321"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-07T16:38:52Z",
+    "nvd_published_at": "2025-04-07T15:15:44Z"
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7524-3396-fqv3",
+  "modified": "2025-04-07T16:38:24Z",
+  "published": "2025-04-07T16:38:24Z",
+  "aliases": [
+    "CVE-2025-31138"
+  ],
+  "summary": "tarteaucitron.js allows UI manipulation via unrestricted CSS injection",
+  "details": "A vulnerability was identified in `tarteaucitron.js`, where user-controlled inputs for element dimensions (`width` and `height`) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like `100%;height:100%;position:fixed;`, potentially covering the entire viewport and facilitating clickjacking attacks.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Overlay malicious UI elements on top of legitimate content,\n- Trick users into interacting with hidden elements (clickjacking),\n- Disrupt the intended functionality and accessibility of the website.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07\nThe issue was resolved by enforcing strict validation and sanitization of user-provided CSS values to prevent unintended UI manipulation.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "tarteaucitronjs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.20.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31138"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/AmauriC/tarteaucitron.js"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1021"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-07T16:38:24Z",
+    "nvd_published_at": "2025-04-07T15:15:44Z"
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q7g5-jq6p-6wvx",
+  "modified": "2025-04-07T16:37:52Z",
+  "published": "2025-04-07T16:37:52Z",
+  "aliases": [
+    "CVE-2025-30373"
+  ],
+  "summary": "Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value",
+  "details": "### Impact\nStarting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.\n\n### Patches\n\n### Workarounds\nDisabling http-based inputs and allow only authenticated pull-based inputs.\n\n### References",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.graylog2:graylog2-server"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.1.0"
+            },
+            {
+              "fixed": "6.1.9"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q7g5-jq6p-6wvx"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30373"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Graylog2/graylog2-server"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-285"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-07T16:37:52Z",
+    "nvd_published_at": "2025-04-07T15:15:43Z"
+  }
+}