From 62457f5fe2d8830edcfa66c7af927f713a3f445b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Feb 2024 00:08:58 +0000 Subject: [PATCH] Publish Advisories GHSA-487g-3m3v-hjhq GHSA-7pjp-fm93-p6pj GHSA-9r26-5w88-qhp9 GHSA-jfrg-9hpq-9hvp GHSA-487g-3m3v-hjhq GHSA-7pjp-fm93-p6pj GHSA-9r26-5w88-qhp9 GHSA-jfrg-9hpq-9hvp --- .../GHSA-487g-3m3v-hjhq.json | 111 ++++++++++++++++++ .../GHSA-7pjp-fm93-p6pj.json | 111 ++++++++++++++++++ .../GHSA-9r26-5w88-qhp9.json | 111 ++++++++++++++++++ .../GHSA-jfrg-9hpq-9hvp.json | 111 ++++++++++++++++++ .../GHSA-487g-3m3v-hjhq.json | 46 -------- .../GHSA-7pjp-fm93-p6pj.json | 46 -------- .../GHSA-9r26-5w88-qhp9.json | 46 -------- .../GHSA-jfrg-9hpq-9hvp.json | 46 -------- 8 files changed, 444 insertions(+), 184 deletions(-) create mode 100644 advisories/github-reviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json diff --git a/advisories/github-reviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json b/advisories/github-reviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json new file mode 100644 index 00000000000..b00b8358cc8 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-487g-3m3v-hjhq", + "modified": "2024-02-21T00:08:30Z", + "published": "2024-02-19T18:31:32Z", + "aliases": [ + "CVE-2024-25978" + ], + "summary": "Uncontrolled Resource Consumption in moodle", + "details": "Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25978" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/9ba14233597480fb78c04d531050c090de4e60a2" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/a73e0ac76d77b67602f91bb211962813d60bc573" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264074" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=455634" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74641" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:08:30Z", + "nvd_published_at": "2024-02-19T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json b/advisories/github-reviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json new file mode 100644 index 00000000000..8571e88bcfa --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7pjp-fm93-p6pj", + "modified": "2024-02-21T00:07:47Z", + "published": "2024-02-19T18:31:32Z", + "aliases": [ + "CVE-2024-25982" + ], + "summary": "Cross-Site Request Forgery in moodle", + "details": "The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25982" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/bac703c534d05d4502580fbe32447d5c777869bf" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264098" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=455638" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-54749" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:07:47Z", + "nvd_published_at": "2024-02-19T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json b/advisories/github-reviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json new file mode 100644 index 00000000000..aaefba398ac --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9r26-5w88-qhp9", + "modified": "2024-02-21T00:08:11Z", + "published": "2024-02-19T18:31:32Z", + "aliases": [ + "CVE-2024-25983" + ], + "summary": "Authorization Bypass in moodle", + "details": "Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25983" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/4cae44dd0e9a7da47d08d9b75e0ebba0e4b422f4" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264099" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=455641" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78300" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:08:11Z", + "nvd_published_at": "2024-02-19T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json b/advisories/github-reviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json new file mode 100644 index 00000000000..d440b13633e --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jfrg-9hpq-9hvp", + "modified": "2024-02-21T00:07:22Z", + "published": "2024-02-19T18:31:32Z", + "aliases": [ + "CVE-2024-25981" + ], + "summary": "Improper Access Control in moodle", + "details": "Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25981" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/1c059cb3fe39da46959e912dc671844dd204e83b" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264097" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=455637" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80504" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:07:22Z", + "nvd_published_at": "2024-02-19T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json b/advisories/unreviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json deleted file mode 100644 index 7fb0a75dca4..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-487g-3m3v-hjhq/GHSA-487g-3m3v-hjhq.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-487g-3m3v-hjhq", - "modified": "2024-02-19T18:31:32Z", - "published": "2024-02-19T18:31:32Z", - "aliases": [ - "CVE-2024-25978" - ], - "details": "Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25978" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264074" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=455634" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74641" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T17:15:08Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json b/advisories/unreviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json deleted file mode 100644 index c08c768a99c..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-7pjp-fm93-p6pj/GHSA-7pjp-fm93-p6pj.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7pjp-fm93-p6pj", - "modified": "2024-02-19T18:31:32Z", - "published": "2024-02-19T18:31:32Z", - "aliases": [ - "CVE-2024-25982" - ], - "details": "The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25982" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264098" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=455638" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-54749" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T17:15:09Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json b/advisories/unreviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json deleted file mode 100644 index a3c488d8c0d..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-9r26-5w88-qhp9/GHSA-9r26-5w88-qhp9.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9r26-5w88-qhp9", - "modified": "2024-02-19T18:31:32Z", - "published": "2024-02-19T18:31:32Z", - "aliases": [ - "CVE-2024-25983" - ], - "details": "Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25983" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264099" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=455641" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78300" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-639" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T17:15:09Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json b/advisories/unreviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json deleted file mode 100644 index bcc6d68a16d..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-jfrg-9hpq-9hvp/GHSA-jfrg-9hpq-9hvp.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jfrg-9hpq-9hvp", - "modified": "2024-02-19T18:31:32Z", - "published": "2024-02-19T18:31:32Z", - "aliases": [ - "CVE-2024-25981" - ], - "details": "Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25981" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264097" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=455637" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80504" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T17:15:09Z" - } -} \ No newline at end of file