diff --git a/advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json b/advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json new file mode 100644 index 00000000000..2533e715f00 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json @@ -0,0 +1,120 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vhr-4mhq-m35c", + "modified": "2024-01-23T17:51:55Z", + "published": "2022-05-13T01:12:50Z", + "aliases": [ + "CVE-2014-0123" + ], + "summary": "Moodle does not properly restrict access", + "details": "The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.6.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0123" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/3a7b9b76c2d3c58237bec56b3b537e05c23970ad" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/d9596365e59ac53787105ff326f7f2bab5b9bada" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/e6499fb8a4463b1130babb09c42f3d5559276d17" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/fa0777902633b54ca5566dd8af304ce5587051e5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=256419" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2014/03/17/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:51:55Z", + "nvd_published_at": "2014-03-24T14:20:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json b/advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json similarity index 83% rename from advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json rename to advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json index 8e179002286..3d9ad4e4b12 100644 --- a/advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json +++ b/advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json @@ -1,17 +1,74 @@ { "schema_version": "1.4.0", "id": "GHSA-5cw4-ggx9-36vg", - "modified": "2022-05-02T03:12:29Z", + "modified": "2024-01-23T17:52:36Z", "published": "2022-05-02T03:12:29Z", "aliases": [ "CVE-2009-0033" ], + "summary": "Apache Tomcat Denial of Service via Malformed Request Headers", "details": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "last_affected": "4.1.39" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.5.0" + }, + { + "last_affected": "5.5.27" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "last_affected": "6.0.18" + } + ] + } + ] + } ], "references": [ { @@ -130,30 +187,6 @@ "type": "WEB", "url": "http://marc.info/?l=bugtraq&m=136485229118404&w=2" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35326" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35344" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35685" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35788" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/37460" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/42368" - }, { "type": "WEB", "url": "http://securitytracker.com/id?1022331" @@ -217,31 +250,16 @@ { "type": "WEB", "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2009/1496" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2009/1856" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2009/3316" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/3056" } ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-400" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:52:36Z", "nvd_published_at": "2009-06-05T16:00:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json b/advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json new file mode 100644 index 00000000000..3464829a5d9 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json @@ -0,0 +1,120 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9m9-494r-w36p", + "modified": "2024-01-23T17:51:44Z", + "published": "2022-05-13T01:12:50Z", + "aliases": [ + "CVE-2014-0122" + ], + "summary": "Moodle allows bypass of intended access restrictions", + "details": "mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.6.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0122" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/3d7810ab3d67a423a760ba89ae75de81d940b236" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/4d4867503c2467cb04660d9cb314d22f56004054" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/5c45ea0c6bf2fdf4dddfaef9fc5ff12e6b426a3f" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/7748e17207b1a28118d9dc622878da22f956d3fe" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=256418" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2014/03/17/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:51:44Z", + "nvd_published_at": "2014-03-24T14:20:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json b/advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json deleted file mode 100644 index 7e2dab2f375..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2vhr-4mhq-m35c", - "modified": "2022-05-13T01:12:50Z", - "published": "2022-05-13T01:12:50Z", - "aliases": [ - "CVE-2014-0123" - ], - "details": "The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0123" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=256419" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2014/03/17/1" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-03-24T14:20:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json b/advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json deleted file mode 100644 index 99dc3fc8c28..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f9m9-494r-w36p", - "modified": "2022-05-13T01:12:50Z", - "published": "2022-05-13T01:12:50Z", - "aliases": [ - "CVE-2014-0122" - ], - "details": "mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0122" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=256418" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2014/03/17/1" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-03-24T14:20:00Z" - } -} \ No newline at end of file