From 57306172b02b4e537a521700e5e045d358b8d760 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 12 Feb 2024 11:51:10 +0000 Subject: [PATCH] Publish Advisories GHSA-427g-2r83-3ccm GHSA-2x2q-2xpv-mcf9 GHSA-6m27-3r8q-c7f7 --- .../GHSA-427g-2r83-3ccm/GHSA-427g-2r83-3ccm.json | 10 +++++++--- .../GHSA-2x2q-2xpv-mcf9/GHSA-2x2q-2xpv-mcf9.json | 14 +++++++++++--- .../GHSA-6m27-3r8q-c7f7/GHSA-6m27-3r8q-c7f7.json | 14 +++++++++++--- 3 files changed, 29 insertions(+), 9 deletions(-) diff --git a/advisories/github-reviewed/2019/11/GHSA-427g-2r83-3ccm/GHSA-427g-2r83-3ccm.json b/advisories/github-reviewed/2019/11/GHSA-427g-2r83-3ccm/GHSA-427g-2r83-3ccm.json index 9973a2f9d74..cd33e9c4085 100644 --- a/advisories/github-reviewed/2019/11/GHSA-427g-2r83-3ccm/GHSA-427g-2r83-3ccm.json +++ b/advisories/github-reviewed/2019/11/GHSA-427g-2r83-3ccm/GHSA-427g-2r83-3ccm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-427g-2r83-3ccm", - "modified": "2021-07-28T15:37:48Z", + "modified": "2024-02-12T11:49:40Z", "published": "2019-11-12T22:59:24Z", "aliases": [ "CVE-2019-8126" ], "summary": "Information disclosure through processing of external XML entities", - "details": "An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.", + "details": "An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.", "severity": [ { "type": "CVSS_V3", @@ -47,7 +47,7 @@ "introduced": "2.3" }, { - "fixed": "2.3.3" + "fixed": "2.3.2-p2" } ] } @@ -59,6 +59,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8126" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8126.yaml" + }, { "type": "WEB", "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" diff --git a/advisories/github-reviewed/2022/05/GHSA-2x2q-2xpv-mcf9/GHSA-2x2q-2xpv-mcf9.json b/advisories/github-reviewed/2022/05/GHSA-2x2q-2xpv-mcf9/GHSA-2x2q-2xpv-mcf9.json index bab5b4ce601..7f68c2c6e1e 100644 --- a/advisories/github-reviewed/2022/05/GHSA-2x2q-2xpv-mcf9/GHSA-2x2q-2xpv-mcf9.json +++ b/advisories/github-reviewed/2022/05/GHSA-2x2q-2xpv-mcf9/GHSA-2x2q-2xpv-mcf9.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-2x2q-2xpv-mcf9", - "modified": "2023-09-26T19:10:43Z", + "modified": "2024-02-12T11:48:50Z", "published": "2022-05-24T17:00:25Z", "aliases": [ "CVE-2019-8127" ], "summary": "Magento 2 Community Edition SQLi Vulnerability", - "details": "A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.", + "details": "A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n", "severity": [ { "type": "CVSS_V3", @@ -47,7 +47,7 @@ "introduced": "2.3.0" }, { - "fixed": "2.3.2-p1" + "fixed": "2.3.2-p2" } ] } @@ -59,10 +59,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8127" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8127.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/magento/magento2" }, + { + "type": "WEB", + "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" + }, { "type": "WEB", "url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" diff --git a/advisories/github-reviewed/2022/05/GHSA-6m27-3r8q-c7f7/GHSA-6m27-3r8q-c7f7.json b/advisories/github-reviewed/2022/05/GHSA-6m27-3r8q-c7f7/GHSA-6m27-3r8q-c7f7.json index e9b755adca3..ac6564282e6 100644 --- a/advisories/github-reviewed/2022/05/GHSA-6m27-3r8q-c7f7/GHSA-6m27-3r8q-c7f7.json +++ b/advisories/github-reviewed/2022/05/GHSA-6m27-3r8q-c7f7/GHSA-6m27-3r8q-c7f7.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6m27-3r8q-c7f7", - "modified": "2023-09-26T19:23:09Z", + "modified": "2024-02-12T11:50:25Z", "published": "2022-05-24T17:00:28Z", "aliases": [ "CVE-2019-8146" ], "summary": "Magento 2 Community Edition XSS Vulnerability", - "details": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores.", + "details": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n", "severity": [ { "type": "CVSS_V3", @@ -47,7 +47,7 @@ "introduced": "2.3.0" }, { - "fixed": "2.3.2-p1" + "fixed": "2.3.2-p2" } ] } @@ -59,10 +59,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8146" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8146.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/magento/magento2" }, + { + "type": "WEB", + "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update" + }, { "type": "WEB", "url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"