From 4fe18a744ff7251afe96a8983cdf087d548079a1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 10 Jan 2024 18:35:12 +0000
Subject: [PATCH] Publish Advisories

GHSA-mp46-7x6q-f28m
GHSA-7hpj-7hhx-2fgx
GHSA-mp46-7x6q-f28m
---
 .../GHSA-mp46-7x6q-f28m.json                  | 65 +++++++++++++++++++
 .../GHSA-7hpj-7hhx-2fgx.json                  |  6 +-
 .../GHSA-mp46-7x6q-f28m.json                  | 35 ----------
 3 files changed, 68 insertions(+), 38 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json b/advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json
new file mode 100644
index 00000000000..35d66ffaa99
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mp46-7x6q-f28m",
+  "modified": "2024-01-10T18:33:55Z",
+  "published": "2022-05-24T19:02:37Z",
+  "aliases": [
+    "CVE-2021-24323"
+  ],
+  "summary": "Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled",
+  "details": "When taxes are enabled, the \"Additional tax classes\" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "woocommerce/woocommerce"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.2.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24323"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/woocommerce/woocommerce/commit/6ede8c5f59aec3ca70aa27d1ffd5a6574473f2ce"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/woocommerce/woocommerce"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-10T18:33:55Z",
+    "nvd_published_at": "2021-05-17T17:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json b/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json
index 90cefb23d4f..2f2b4453f5b 100644
--- a/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json
+++ b/advisories/github-reviewed/2023/12/GHSA-7hpj-7hhx-2fgx/GHSA-7hpj-7hhx-2fgx.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7hpj-7hhx-2fgx",
-  "modified": "2023-12-28T21:16:20Z",
+  "modified": "2024-01-10T18:34:21Z",
   "published": "2023-12-28T21:16:20Z",
   "aliases": [
     "CVE-2023-52079"
@@ -11,7 +11,7 @@
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
     }
   ],
   "affected": [
@@ -57,7 +57,7 @@
     "cwe_ids": [
       "CWE-674"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-12-28T21:16:20Z",
     "nvd_published_at": "2023-12-28T16:16:01Z"
diff --git a/advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json b/advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json
deleted file mode 100644
index 950af6a0170..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-mp46-7x6q-f28m/GHSA-mp46-7x6q-f28m.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-mp46-7x6q-f28m",
-  "modified": "2022-05-24T19:02:37Z",
-  "published": "2022-05-24T19:02:37Z",
-  "aliases": [
-    "CVE-2021-24323"
-  ],
-  "details": "When taxes are enabled, the \"Additional tax classes\" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24323"
-    },
-    {
-      "type": "WEB",
-      "url": "https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-79"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2021-05-17T17:15:00Z"
-  }
-}
\ No newline at end of file