diff --git a/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json b/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json new file mode 100644 index 00000000000..d30d1977858 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8886-8v27-85j8", + "modified": "2024-11-14T15:37:04Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52552" + ], + "summary": "Stored XSS vulnerability in Jenkins Authorize Project Plugin ", + "details": "Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Authorize Project Plugin 1.8.0 no longer evaluates a string containing the job name with JavaScript on the Authorization view.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:authorize-project" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52552" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/authorize-project-plugin" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3010" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-14T15:37:04Z", + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json b/advisories/github-reviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json new file mode 100644 index 00000000000..35ce02efce3 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv82-75fh-23r7", + "modified": "2024-11-14T15:35:54Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52549" + ], + "summary": "Missing permission check in Jenkins Script Security Plugin ", + "details": "Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:script-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1368.vb" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52549" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/script-security-plugin" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306", + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-14T15:35:54Z", + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json b/advisories/unreviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json deleted file mode 100644 index d90fafaa0bf..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8886-8v27-85j8", - "modified": "2024-11-13T21:30:38Z", - "published": "2024-11-13T21:30:38Z", - "aliases": [ - "CVE-2024-52552" - ], - "details": "Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52552" - }, - { - "type": "WEB", - "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3010" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-13T21:15:29Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json b/advisories/unreviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json deleted file mode 100644 index 9073dbb8848..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jv82-75fh-23r7", - "modified": "2024-11-13T21:30:38Z", - "published": "2024-11-13T21:30:38Z", - "aliases": [ - "CVE-2024-52549" - ], - "details": "Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52549" - }, - { - "type": "WEB", - "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-13T21:15:29Z" - } -} \ No newline at end of file