From 4df5245c2656a412f69ff99b5986a1dd6f7bde53 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 14 May 2024 17:21:29 +0000 Subject: [PATCH] Publish Advisories GHSA-593c-j348-f3gv GHSA-mq3q-jjph-rp5p GHSA-mwv2-398h-v489 --- .../GHSA-593c-j348-f3gv.json | 33 +++++++++++++--- .../GHSA-mq3q-jjph-rp5p.json | 33 +++++++++++++--- .../GHSA-mwv2-398h-v489.json | 38 +++++++++++++++++-- 3 files changed, 90 insertions(+), 14 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json (58%) diff --git a/advisories/unreviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json b/advisories/github-reviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json rename to advisories/github-reviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json index a4c4f5eba72..f227b470970 100644 --- a/advisories/unreviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json +++ b/advisories/github-reviewed/2022/05/GHSA-593c-j348-f3gv/GHSA-593c-j348-f3gv.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-593c-j348-f3gv", - "modified": "2022-05-01T23:39:38Z", + "modified": "2024-05-14T17:20:01Z", "published": "2022-05-01T23:39:38Z", "aliases": [ "CVE-2008-1393" ], - "details": "Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.", + "summary": "Plone Improper Session Management", + "details": "Plone CMS before 3, places a base64 encoded form of the username and password in the `__ac` cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "Plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41427" }, + { + "type": "PACKAGE", + "url": "https://github.com/plone/Plone" + }, { "type": "WEB", "url": "http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords" @@ -48,8 +71,8 @@ ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T17:20:01Z", "nvd_published_at": "2008-03-20T00:44:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json b/advisories/github-reviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json rename to advisories/github-reviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json index e1f2044e4b1..87f508f8d71 100644 --- a/advisories/unreviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json +++ b/advisories/github-reviewed/2022/05/GHSA-mq3q-jjph-rp5p/GHSA-mq3q-jjph-rp5p.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-mq3q-jjph-rp5p", - "modified": "2022-05-01T23:39:37Z", + "modified": "2024-05-14T17:20:03Z", "published": "2022-05-01T23:39:37Z", "aliases": [ "CVE-2008-1394" ], - "details": "Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.", + "summary": "Plone CMS Improper Session Management", + "details": "Plone CMS before 3 places a base64 encoded form of the username and password in the `__ac` cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "Plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41425" }, + { + "type": "PACKAGE", + "url": "https://github.com/plone/Plone" + }, { "type": "WEB", "url": "http://plone.org/about/security/overview/security-overview-of-plone" @@ -44,8 +67,8 @@ ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T17:20:03Z", "nvd_published_at": "2008-03-20T00:44:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json b/advisories/github-reviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json rename to advisories/github-reviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json index 1b9c1112a97..991336b09f6 100644 --- a/advisories/unreviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json +++ b/advisories/github-reviewed/2022/05/GHSA-mwv2-398h-v489/GHSA-mwv2-398h-v489.json @@ -1,27 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-mwv2-398h-v489", - "modified": "2022-05-01T17:44:04Z", + "modified": "2024-05-14T17:18:53Z", "published": "2022-05-01T17:44:04Z", "aliases": [ "CVE-2007-0405" ], + "summary": "Django Improper Access Control", "details": "The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "Django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.95" + }, + { + "fixed": "1.0" + } + ] + } + ], + "versions": [ + "0.95" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-0405" }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/3c5782287e" + }, { "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31628" }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, { "type": "WEB", "url": "http://code.djangoproject.com/changeset/3754" @@ -40,8 +70,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T17:18:53Z", "nvd_published_at": "2007-01-23T00:28:00Z" } } \ No newline at end of file