From 50f21e93adac8c3dd4703ac763ea49d5365859d1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 23 May 2024 17:13:37 +0000
Subject: [PATCH] Publish Advisories

GHSA-64x4-9hc6-r2h6
GHSA-vp8p-c6xj-xpj7
---
 .../GHSA-64x4-9hc6-r2h6.json                  | 59 +++++++++++-
 .../GHSA-vp8p-c6xj-xpj7.json                  | 94 +++++++++++++++++++
 2 files changed, 152 insertions(+), 1 deletion(-)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-vp8p-c6xj-xpj7/GHSA-vp8p-c6xj-xpj7.json

diff --git a/advisories/github-reviewed/2022/07/GHSA-64x4-9hc6-r2h6/GHSA-64x4-9hc6-r2h6.json b/advisories/github-reviewed/2022/07/GHSA-64x4-9hc6-r2h6/GHSA-64x4-9hc6-r2h6.json
index 51570f4dfdf..391b0b8e48f 100644
--- a/advisories/github-reviewed/2022/07/GHSA-64x4-9hc6-r2h6/GHSA-64x4-9hc6-r2h6.json
+++ b/advisories/github-reviewed/2022/07/GHSA-64x4-9hc6-r2h6/GHSA-64x4-9hc6-r2h6.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-64x4-9hc6-r2h6",
-  "modified": "2022-07-21T22:35:57Z",
+  "modified": "2024-05-23T17:12:42Z",
   "published": "2022-07-13T00:00:39Z",
   "aliases": [
     "CVE-2022-30187"
@@ -52,6 +52,63 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.azure:azure-storage-blob"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "12.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "azure-storage-queue"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "12.4.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "azure-storage-blob"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "12.13.0"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
diff --git a/advisories/github-reviewed/2024/05/GHSA-vp8p-c6xj-xpj7/GHSA-vp8p-c6xj-xpj7.json b/advisories/github-reviewed/2024/05/GHSA-vp8p-c6xj-xpj7/GHSA-vp8p-c6xj-xpj7.json
new file mode 100644
index 00000000000..305d0df92fe
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-vp8p-c6xj-xpj7/GHSA-vp8p-c6xj-xpj7.json
@@ -0,0 +1,94 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vp8p-c6xj-xpj7",
+  "modified": "2024-05-23T17:12:13Z",
+  "published": "2024-05-23T17:12:13Z",
+  "aliases": [
+
+  ],
+  "summary": "Silverstripe External redirection risk in Security?ReturnURL",
+  "details": "A vulnerability has been found in the SilverStripe framework where a login url can be potentially redirected to an external site.\n\nFor example, the url http://www.my-silverstripe-site.com/Security/login?BackURL=/\\attacker-site.com will redirect successful logins to the page http://attacker-site.com. If that website were set up to look identical to the first with \"login failed\" then the user will likely just enter their user/pass again.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0.14"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.0.13"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.1.0"
+            },
+            {
+              "fixed": "3.1.13"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.1.13-rc1"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/silverstripe/silverstripe-framework/commit/22a35e48a9f513d4caa3b4e9b8dd21c49ffc8f2c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/silverstripe/silverstripe-framework/commit/c14e7f6b764ae4646461f3fc3a46452fdaa9e02a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-012-1.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/silverstripe/silverstripe-framework"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.silverstripe.org/software/download/security-releases/ss-2015-012"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-601"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-23T17:12:13Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file