From 5149d4ebb2737d420f1c1f328e8ef1bb570ce97e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Jan 2024 17:53:45 +0000 Subject: [PATCH] Publish Advisories GHSA-2vhr-4mhq-m35c GHSA-5cw4-ggx9-36vg GHSA-f9m9-494r-w36p GHSA-2vhr-4mhq-m35c GHSA-f9m9-494r-w36p --- .../GHSA-2vhr-4mhq-m35c.json | 120 ++++++++++++++++++ .../GHSA-5cw4-ggx9-36vg.json | 108 +++++++++------- .../GHSA-f9m9-494r-w36p.json | 120 ++++++++++++++++++ .../GHSA-2vhr-4mhq-m35c.json | 43 ------- .../GHSA-f9m9-494r-w36p.json | 43 ------- 5 files changed, 303 insertions(+), 131 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json (83%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json diff --git a/advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json b/advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json new file mode 100644 index 00000000000..2533e715f00 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json @@ -0,0 +1,120 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vhr-4mhq-m35c", + "modified": "2024-01-23T17:51:55Z", + "published": "2022-05-13T01:12:50Z", + "aliases": [ + "CVE-2014-0123" + ], + "summary": "Moodle does not properly restrict access", + "details": "The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.6.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0123" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/3a7b9b76c2d3c58237bec56b3b537e05c23970ad" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/d9596365e59ac53787105ff326f7f2bab5b9bada" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/e6499fb8a4463b1130babb09c42f3d5559276d17" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/fa0777902633b54ca5566dd8af304ce5587051e5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=256419" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2014/03/17/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:51:55Z", + "nvd_published_at": "2014-03-24T14:20:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json b/advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json similarity index 83% rename from advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json rename to advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json index 8e179002286..3d9ad4e4b12 100644 --- a/advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json +++ b/advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json @@ -1,17 +1,74 @@ { "schema_version": "1.4.0", "id": "GHSA-5cw4-ggx9-36vg", - "modified": "2022-05-02T03:12:29Z", + "modified": "2024-01-23T17:52:36Z", "published": "2022-05-02T03:12:29Z", "aliases": [ "CVE-2009-0033" ], + "summary": "Apache Tomcat Denial of Service via Malformed Request Headers", "details": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "last_affected": "4.1.39" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.5.0" + }, + { + "last_affected": "5.5.27" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "last_affected": "6.0.18" + } + ] + } + ] + } ], "references": [ { @@ -130,30 +187,6 @@ "type": "WEB", "url": "http://marc.info/?l=bugtraq&m=136485229118404&w=2" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35326" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35344" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35685" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35788" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/37460" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/42368" - }, { "type": "WEB", "url": "http://securitytracker.com/id?1022331" @@ -217,31 +250,16 @@ { "type": "WEB", "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2009/1496" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2009/1856" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2009/3316" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/3056" } ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-400" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:52:36Z", "nvd_published_at": "2009-06-05T16:00:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json b/advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json new file mode 100644 index 00000000000..3464829a5d9 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json @@ -0,0 +1,120 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9m9-494r-w36p", + "modified": "2024-01-23T17:51:44Z", + "published": "2022-05-13T01:12:50Z", + "aliases": [ + "CVE-2014-0122" + ], + "summary": "Moodle allows bypass of intended access restrictions", + "details": "mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.6.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0122" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/3d7810ab3d67a423a760ba89ae75de81d940b236" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/4d4867503c2467cb04660d9cb314d22f56004054" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/5c45ea0c6bf2fdf4dddfaef9fc5ff12e6b426a3f" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/7748e17207b1a28118d9dc622878da22f956d3fe" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=256418" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2014/03/17/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:51:44Z", + "nvd_published_at": "2014-03-24T14:20:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json b/advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json deleted file mode 100644 index 7e2dab2f375..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2vhr-4mhq-m35c", - "modified": "2022-05-13T01:12:50Z", - "published": "2022-05-13T01:12:50Z", - "aliases": [ - "CVE-2014-0123" - ], - "details": "The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0123" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=256419" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2014/03/17/1" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-03-24T14:20:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json b/advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json deleted file mode 100644 index 99dc3fc8c28..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f9m9-494r-w36p", - "modified": "2022-05-13T01:12:50Z", - "published": "2022-05-13T01:12:50Z", - "aliases": [ - "CVE-2014-0122" - ], - "details": "mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0122" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=256418" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2014/03/17/1" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-03-24T14:20:00Z" - } -} \ No newline at end of file