netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2444-8gj8-6fmx
GHSA-4h7p-4vq8-g2gh
GHSA-2444-8gj8-6fmx
GHSA-4h7p-4vq8-g2gh
This commit is contained in:
advisory-database[bot]
2025-03-04 16:19:37 +00:00
parent b88da54d31
commit 59ba8e1e07
4 changed files with 248 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/03/GHSA-2444-8gj8-6fmx/GHSA-2444-8gj8-6fmx.json
+124
View File
@@ -0,0 +1,124 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2444-8gj8-6fmx",
"modified": "2025-03-04T16:18:00Z",
"published": "2023-03-27T21:30:25Z",
"aliases": [
"CVE-2023-22247"
],
"summary": "Magento Open Source allows XML Injection",
"details": "Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.5-p1"
},
{
"fixed": "2.4.5-p2"
}
]
}
],
"versions": [
"2.4.5-p1"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.5"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.4-p1"
},
{
"fixed": "2.4.4-p3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.4"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/project-community-edition"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22247"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb23-17.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-91"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-03-04T16:18:00Z",
"nvd_published_at": "2023-03-27T21:15:00Z"
}
}
advisories/github-reviewed/2023/03/GHSA-4h7p-4vq8-g2gh/GHSA-4h7p-4vq8-g2gh.json
+124
View File
@@ -0,0 +1,124 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4h7p-4vq8-g2gh",
"modified": "2025-03-04T16:16:10Z",
"published": "2023-03-27T21:30:25Z",
"aliases": [
"CVE-2023-22250"
],
"summary": "Magento Open Source allows Improper Access Control",
"details": "Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.4-p1"
},
{
"fixed": "2.4.4-p3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.4"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.5"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.5-p1"
},
{
"fixed": "2.4.5-p2"
}
]
}
],
"versions": [
"2.4.5-p1"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/project-community-edition"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22250"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb23-17.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-04T16:16:10Z",
"nvd_published_at": "2023-03-27T21:15:00Z"
}
}
advisories/unreviewed/2023/03/GHSA-2444-8gj8-6fmx/GHSA-2444-8gj8-6fmx.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2444-8gj8-6fmx",
"modified": "2023-03-27T21:30:25Z",
"published": "2023-03-27T21:30:25Z",
"aliases": [
"CVE-2023-22247"
],
"details": "Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22247"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb23-17.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-91"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-27T21:15:00Z"
}
}
advisories/unreviewed/2023/03/GHSA-4h7p-4vq8-g2gh/GHSA-4h7p-4vq8-g2gh.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4h7p-4vq8-g2gh",
"modified": "2023-03-27T21:30:25Z",
"published": "2023-03-27T21:30:25Z",
"aliases": [
"CVE-2023-22250"
],
"details": "Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22250"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb23-17.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-27T21:15:00Z"
}
}