From 4e1e2be12e27a3da9b3a7b926928ff980a8ab82b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 4 Mar 2025 18:22:43 +0000 Subject: [PATCH] Publish Advisories GHSA-5xmp-7wg5-x68q GHSA-8jxc-5f94-22vh GHSA-5xmp-7wg5-x68q GHSA-8jxc-5f94-22vh --- .../GHSA-5xmp-7wg5-x68q.json | 124 ++++++++++++ .../GHSA-8jxc-5f94-22vh.json | 180 ++++++++++++++++++ .../GHSA-5xmp-7wg5-x68q.json | 36 ---- .../GHSA-8jxc-5f94-22vh.json | 36 ---- 4 files changed, 304 insertions(+), 72 deletions(-) create mode 100644 advisories/github-reviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json create mode 100644 advisories/github-reviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json delete mode 100644 advisories/unreviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json delete mode 100644 advisories/unreviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json diff --git a/advisories/github-reviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json b/advisories/github-reviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json new file mode 100644 index 00000000000..43f9642d8f7 --- /dev/null +++ b/advisories/github-reviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json @@ -0,0 +1,124 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xmp-7wg5-x68q", + "modified": "2025-03-04T18:19:31Z", + "published": "2023-09-18T15:30:18Z", + "aliases": [ + "CVE-2022-24093" + ], + "summary": "Magento Open Source affected by Improper Input Validation", + "details": "Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.3" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.3.7" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.3-p1" + }, + { + "fixed": "2.4.3-p2" + } + ] + } + ], + "versions": [ + "2.4.3-p1" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.7-p1" + }, + { + "fixed": "2.3.7-p3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/project-community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24093" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb22-13.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-04T18:19:31Z", + "nvd_published_at": "2023-09-12T08:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json b/advisories/github-reviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json new file mode 100644 index 00000000000..5509805b9b7 --- /dev/null +++ b/advisories/github-reviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json @@ -0,0 +1,180 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8jxc-5f94-22vh", + "modified": "2025-03-04T18:20:03Z", + "published": "2023-10-13T09:30:22Z", + "aliases": [ + "CVE-2023-26366" + ], + "summary": "Magento Open Source allows Server-Side Request Forgery (SSRF)", + "details": "Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.7-beta1" + }, + { + "fixed": "2.4.7-beta2" + } + ] + } + ], + "versions": [ + "2.4.7-beta1" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.7" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.6" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.5" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.4" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.6-p1" + }, + { + "fixed": "2.4.6-p3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.5-p1" + }, + { + "fixed": "2.4.5-p5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.4-p1" + }, + { + "fixed": "2.4.4-p6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/project-community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26366" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb23-50.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-04T18:20:03Z", + "nvd_published_at": "2023-10-13T07:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json b/advisories/unreviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json deleted file mode 100644 index ffa23010f89..00000000000 --- a/advisories/unreviewed/2023/09/GHSA-5xmp-7wg5-x68q/GHSA-5xmp-7wg5-x68q.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5xmp-7wg5-x68q", - "modified": "2024-04-04T07:43:15Z", - "published": "2023-09-18T15:30:18Z", - "aliases": [ - "CVE-2022-24093" - ], - "details": "Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24093" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb22-13.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-09-12T08:15:12Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json b/advisories/unreviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json deleted file mode 100644 index 60bb57f4e95..00000000000 --- a/advisories/unreviewed/2023/10/GHSA-8jxc-5f94-22vh/GHSA-8jxc-5f94-22vh.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8jxc-5f94-22vh", - "modified": "2024-04-04T08:37:25Z", - "published": "2023-10-13T09:30:22Z", - "aliases": [ - "CVE-2023-26366" - ], - "details": "Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26366" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb23-50.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-918" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-10-13T07:15:38Z" - } -} \ No newline at end of file