Publish Advisories

GHSA-593c-j348-f3gv
GHSA-mq3q-jjph-rp5p
GHSA-mwv2-398h-v489

advisories/github-reviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json

@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-593c-j348-f3gv",
-  "modified": "2022-05-01T23:39:38Z",
+  "modified": "2024-05-14T17:20:01Z",
   "published": "2022-05-01T23:39:38Z",
   "aliases": [
     "CVE-2008-1393"
   ],
-  "details": "Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.",
+  "summary": "Plone Improper Session Management",
+  "details": "Plone CMS before 3, places a base64 encoded form of the username and password in the `__ac` cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "Plone"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -22,6 +41,10 @@
       "type": "WEB",
       "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41427"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/plone/Plone"
+    },
     {
       "type": "WEB",
       "url": "http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords"
@@ -48,8 +71,8 @@
 
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-14T17:20:01Z",
     "nvd_published_at": "2008-03-20T00:44:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json

@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mq3q-jjph-rp5p",
-  "modified": "2022-05-01T23:39:37Z",
+  "modified": "2024-05-14T17:20:03Z",
   "published": "2022-05-01T23:39:37Z",
   "aliases": [
     "CVE-2008-1394"
   ],
-  "details": "Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.",
+  "summary": "Plone CMS Improper Session Management",
+  "details": "Plone CMS before 3 places a base64 encoded form of the username and password in the `__ac` cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "Plone"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -22,6 +41,10 @@
       "type": "WEB",
       "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41425"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/plone/Plone"
+    },
     {
       "type": "WEB",
       "url": "http://plone.org/about/security/overview/security-overview-of-plone"
@@ -44,8 +67,8 @@
 
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-14T17:20:03Z",
     "nvd_published_at": "2008-03-20T00:44:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json

@@ -1,27 +1,57 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mwv2-398h-v489",
-  "modified": "2022-05-01T17:44:04Z",
+  "modified": "2024-05-14T17:18:53Z",
   "published": "2022-05-01T17:44:04Z",
   "aliases": [
     "CVE-2007-0405"
   ],
+  "summary": "Django Improper Access Control",
   "details": "The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "Django"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.95"
+            },
+            {
+              "fixed": "1.0"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "0.95"
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-0405"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/django/django/commit/3c5782287e"
+    },
     {
       "type": "WEB",
       "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31628"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/django/django"
+    },
     {
       "type": "WEB",
       "url": "http://code.djangoproject.com/changeset/3754"
@@ -40,8 +70,8 @@
 
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-14T17:18:53Z",
     "nvd_published_at": "2007-01-23T00:28:00Z"
   }
 }