From 4c88e9f788141b8e8549c9ca6c19f05d31702539 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 10 Jul 2024 14:28:02 +0000
Subject: [PATCH] Publish Advisories

GHSA-vfwh-gvf6-mff8
GHSA-vfwh-gvf6-mff8
---
 .../GHSA-vfwh-gvf6-mff8.json                  | 92 +++++++++++++++++++
 .../GHSA-vfwh-gvf6-mff8.json                  | 39 --------
 2 files changed, 92 insertions(+), 39 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json
 delete mode 100644 advisories/unreviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json

diff --git a/advisories/github-reviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json b/advisories/github-reviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json
new file mode 100644
index 00000000000..c52646e84c2
--- /dev/null
+++ b/advisories/github-reviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vfwh-gvf6-mff8",
+  "modified": "2024-07-10T14:26:29Z",
+  "published": "2024-07-09T21:30:39Z",
+  "aliases": [
+    "CVE-2024-39031"
+  ],
+  "summary": "Silverpeas Core Cross-site Scripting vulnerability",
+  "details": "In Silverpeas Core <= 6.3.5, inside of mes agendas a user can create a new event and add it to his calendar. The user can also add other users to the event from the same domain, including administrator. A normal user can create an event with XSS payload inside `Titre` and `Description` parameters and add the administrator or any user to the event. When the other user (victim) visits his own profile (even without clicking on the event) the payload will be executed on the victim side.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.silverpeas.core:silverpeas-core-rs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "6.3.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.silverpeas.core:silverpeas-core-seb"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "6.3.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39031"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Silverpeas/Silverpeas-Core/commit/a0289f8a6f8b6a9ebc399973093118ddb48b77d8"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Silverpeas/Silverpeas-Core"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/toneemarqus/CVE-2024-39031"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.github.com/Silverpeas/Silverpeas-Core/pull/1346"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-10T14:26:29Z",
+    "nvd_published_at": "2024-07-09T21:15:15Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json b/advisories/unreviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json
deleted file mode 100644
index 2aa4459e1e2..00000000000
--- a/advisories/unreviewed/2024/07/GHSA-vfwh-gvf6-mff8/GHSA-vfwh-gvf6-mff8.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-vfwh-gvf6-mff8",
-  "modified": "2024-07-09T21:30:39Z",
-  "published": "2024-07-09T21:30:39Z",
-  "aliases": [
-    "CVE-2024-39031"
-  ],
-  "details": "In Silverpeas Core <= 6.3.5, inside of mes agendas a user can create a new event and add it to his calendar. The user can also add other users to the event from the same domain, including administrator. A normal user can create an event with XSS payload inside “Titre” and “Description” parameters and add the administrator or any user to the event. When the other user (victim) visits his own profile (even without clicking on the event) the payload will be executed on the victim side.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39031"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/toneemarqus/CVE-2024-39031"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.github.com/Silverpeas/Silverpeas-Core/pull/1346"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-07-09T21:15:15Z"
-  }
-}
\ No newline at end of file