diff --git a/advisories/unreviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json b/advisories/github-reviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json rename to advisories/github-reviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json index 2e6ba0f3393..19bcfd28116 100644 --- a/advisories/unreviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json +++ b/advisories/github-reviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json @@ -1,23 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-2gcp-xwxg-hqg3", - "modified": "2022-05-24T17:27:13Z", + "modified": "2024-04-24T20:31:34Z", "published": "2022-05-24T17:27:13Z", "aliases": [ "CVE-2020-14209" ], + "summary": "Dolibarr Unrestricted Upload of File with Dangerous Type", "details": "Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.0.5" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14209" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/releases/tag/11.0.5" @@ -35,9 +61,9 @@ "cwe_ids": [ "CWE-434" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:31:34Z", "nvd_published_at": "2020-09-02T17:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json b/advisories/github-reviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json rename to advisories/github-reviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json index 36bec32e02f..98773d072e7 100644 --- a/advisories/unreviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json +++ b/advisories/github-reviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7x8g-h246-gvx3", - "modified": "2022-11-17T18:30:30Z", + "modified": "2024-04-24T20:31:29Z", "published": "2022-05-24T17:37:06Z", "aliases": [ "CVE-2020-35136" ], + "summary": "Dolibarr authenticated Remote Code Execution", "details": "Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.0.3" + } + } ], "references": [ { @@ -25,6 +47,10 @@ "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47ebcbac" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/releases" @@ -44,8 +70,8 @@ "CWE-88" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:31:29Z", "nvd_published_at": "2020-12-23T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json b/advisories/github-reviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json similarity index 68% rename from advisories/unreviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json rename to advisories/github-reviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json index 5dd29576801..49de27996a3 100644 --- a/advisories/unreviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json +++ b/advisories/github-reviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-97fp-5m87-r9mf", - "modified": "2022-11-17T18:30:28Z", + "modified": "2024-04-24T20:31:24Z", "published": "2022-05-24T16:50:15Z", "aliases": [ "CVE-2019-1010016" ], + "summary": "Dolibarr Cross Site Scripting (XSS)", "details": "Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.", "severity": [ { @@ -14,7 +15,15 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "6.0.4" + ] + } ], "references": [ { @@ -24,6 +33,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/issues/7962" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:31:24Z", "nvd_published_at": "2019-07-15T03:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json b/advisories/github-reviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json similarity index 70% rename from advisories/unreviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json rename to advisories/github-reviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json index 1a8f848be5d..3ad96569b16 100644 --- a/advisories/unreviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json +++ b/advisories/github-reviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hwmc-v6j6-gc2p", - "modified": "2022-11-17T18:30:28Z", + "modified": "2024-04-24T20:31:20Z", "published": "2022-05-24T16:50:37Z", "aliases": [ "CVE-2019-1010054" ], + "summary": "Dolibarr Cross Site Request Forgery (CSRF)", "details": "Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "7.0.0" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010054" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF" @@ -31,8 +44,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:31:20Z", "nvd_published_at": "2019-07-18T13:15:00Z" } } \ No newline at end of file