diff --git a/advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json b/advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json new file mode 100644 index 00000000000..35d66ffaa99 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mp46-7x6q-f28m", + "modified": "2024-01-10T18:33:55Z", + "published": "2022-05-24T19:02:37Z", + "aliases": [ + "CVE-2021-24323" + ], + "summary": "Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled", + "details": "When taxes are enabled, the \"Additional tax classes\" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "woocommerce/woocommerce" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.2.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24323" + }, + { + "type": "WEB", + "url": "https://github.com/woocommerce/woocommerce/commit/6ede8c5f59aec3ca70aa27d1ffd5a6574473f2ce" + }, + { + "type": "PACKAGE", + "url": "https://github.com/woocommerce/woocommerce" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-10T18:33:55Z", + "nvd_published_at": "2021-05-17T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json b/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json index 90cefb23d4f..2f2b4453f5b 100644 --- a/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json +++ b/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7hpj-7hhx-2fgx", - "modified": "2023-12-28T21:16:20Z", + "modified": "2024-01-10T18:34:21Z", "published": "2023-12-28T21:16:20Z", "aliases": [ "CVE-2023-52079" @@ -11,7 +11,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" } ], "affected": [ @@ -57,7 +57,7 @@ "cwe_ids": [ "CWE-674" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-12-28T21:16:20Z", "nvd_published_at": "2023-12-28T16:16:01Z" diff --git a/advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json b/advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json deleted file mode 100644 index 950af6a0170..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mp46-7x6q-f28m", - "modified": "2022-05-24T19:02:37Z", - "published": "2022-05-24T19:02:37Z", - "aliases": [ - "CVE-2021-24323" - ], - "details": "When taxes are enabled, the \"Additional tax classes\" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24323" - }, - { - "type": "WEB", - "url": "https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-05-17T17:15:00Z" - } -} \ No newline at end of file