netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8h93-28hg-fj84
GHSA-wxcc-2f3q-4h58
GHSA-8h93-28hg-fj84
GHSA-wxcc-2f3q-4h58
This commit is contained in:
advisory-database[bot]
2025-01-31 21:07:21 +00:00
parent 3adaaf3e9b
commit 522abaae0a
4 changed files with 278 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json
+119
View File
@@ -0,0 +1,119 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8h93-28hg-fj84",
"modified": "2025-01-31T21:06:18Z",
"published": "2025-01-08T21:32:25Z",
"aliases": [
"CVE-2024-53526"
],
"summary": "Composio Command Execution vulnerability",
"details": "composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "composio-claude"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.5.40"
},
{
"fixed": "0.6.9"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "composio-openai"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.5.40"
},
{
"fixed": "0.6.9"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "composio-julep"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.5.40"
},
{
"fixed": "0.6.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53526"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/issues/1073"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/pull/1107"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/commit/f496f7fa776335ae7825cad2991c9b38923271fc"
},
{
"type": "PACKAGE",
"url": "https://github.com/ComposioHQ/composio"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-01-31T21:06:18Z",
"nvd_published_at": "2025-01-08T19:15:37Z"
}
}
advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json
+159
View File
@@ -0,0 +1,159 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wxcc-2f3q-4h58",
"modified": "2025-01-31T21:06:23Z",
"published": "2025-01-31T18:31:07Z",
"aliases": [
"CVE-2024-11741"
],
"summary": "Grafana Alerting VictorOps integration could be exposed to users with Viewer permission",
"details": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.4.0"
},
{
"fixed": "11.4.1"
}
]
}
],
"versions": [
"11.4.0"
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.3.0"
},
{
"fixed": "11.3.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.2.0"
},
{
"fixed": "11.2.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.1.0"
},
{
"fixed": "11.1.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "10.4.15"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11741"
},
{
"type": "PACKAGE",
"url": "https://github.com/grafana/grafana"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/cve-2024-11741"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-01-31T21:06:23Z",
"nvd_published_at": "2025-01-31T16:15:30Z"
}
}
advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json
-48
View File
@@ -1,48 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8h93-28hg-fj84",
"modified": "2025-01-31T18:31:04Z",
"published": "2025-01-08T21:32:25Z",
"aliases": [
"CVE-2024-53526"
],
"details": "composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53526"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/issues/1073"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21"
},
{
"type": "WEB",
"url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T19:15:37Z"
}
}
advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wxcc-2f3q-4h58",
"modified": "2025-01-31T18:31:07Z",
"published": "2025-01-31T18:31:07Z",
"aliases": [
"CVE-2024-11741"
],
"details": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,  11.2.6, 11.1.11, 11.0.11 and 10.4.15",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11741"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/cve-2024-11741"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-31T16:15:30Z"
}
}