From 641f91c02a5fb8f621a7d549feda848d62dfae6b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 13 Nov 2024 18:38:38 +0000 Subject: [PATCH] Publish Advisories GHSA-cgr4-c233-h733 GHSA-xhg6-9j5j-w4vf --- .../GHSA-cgr4-c233-h733.json | 71 +++++++++++++++++++ .../GHSA-xhg6-9j5j-w4vf.json | 38 +++++++--- 2 files changed, 101 insertions(+), 8 deletions(-) create mode 100644 advisories/github-reviewed/2024/11/GHSA-cgr4-c233-h733/GHSA-cgr4-c233-h733.json rename advisories/{unreviewed => github-reviewed}/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json (62%) diff --git a/advisories/github-reviewed/2024/11/GHSA-cgr4-c233-h733/GHSA-cgr4-c233-h733.json b/advisories/github-reviewed/2024/11/GHSA-cgr4-c233-h733/GHSA-cgr4-c233-h733.json new file mode 100644 index 00000000000..72f00062bba --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-cgr4-c233-h733/GHSA-cgr4-c233-h733.json @@ -0,0 +1,71 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cgr4-c233-h733", + "modified": "2024-11-13T18:37:15Z", + "published": "2024-11-13T18:37:15Z", + "aliases": [ + "CVE-2024-52305" + ], + "summary": "UnoPim Stored XSS : Cookie hijacking through Create User function", + "details": "### Summary\nA vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.\n\n### Details\n1. Login as admin\n2. Go to Create User\n3. Fill up everything in the registration form then upload SVG image as a profile picture\n4. In SVG image, add script tag to prepare for XSS attack\n5. Complete the Create User process\n6. Right click at the image to obtain image URL address\n7. XSS triggered\n### PoC\nThe below link is a private YouTube video for PoC. \nhttps://youtu.be/5j8owD0--1A\n\n### Impact\nThe stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "unopim/unopim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/unopim/unopim/security/advisories/GHSA-cgr4-c233-h733" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52305" + }, + { + "type": "WEB", + "url": "https://github.com/unopim/unopim/commit/9a0da7a0892c60f58df2351b5a9498dcb4cb8b7a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/unopim/unopim" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-616", + "CWE-692", + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-13T18:37:15Z", + "nvd_published_at": "2024-11-13T16:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json b/advisories/github-reviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json similarity index 62% rename from advisories/unreviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json rename to advisories/github-reviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json index 870f231a9e8..c2e1f475f9b 100644 --- a/advisories/unreviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json +++ b/advisories/github-reviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-xhg6-9j5j-w4vf", - "modified": "2024-11-13T15:31:37Z", + "modified": "2024-11-13T18:38:01Z", "published": "2024-11-13T15:31:37Z", "aliases": [ "CVE-2024-48510" ], + "summary": "DotNetZip Directory Traversal vulnerability", "details": "Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "severity": [ - + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "NuGet", + "name": "DotNetZip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.10.1" + }, + { + "last_affected": "1.16.0" + } + ] + } + ] + } ], "references": [ { @@ -23,7 +45,7 @@ "url": "https://gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/haf/DotNetZip.Semverd" }, { @@ -37,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-13T18:38:01Z", "nvd_published_at": "2024-11-13T15:15:07Z" } } \ No newline at end of file