diff --git a/advisories/github-reviewed/2024/07/GHSA-xrh7-2gfq-4rcq/GHSA-xrh7-2gfq-4rcq.json b/advisories/github-reviewed/2024/07/GHSA-xrh7-2gfq-4rcq/GHSA-xrh7-2gfq-4rcq.json index 76fdbfa553b..3b8ebfc6826 100644 --- a/advisories/github-reviewed/2024/07/GHSA-xrh7-2gfq-4rcq/GHSA-xrh7-2gfq-4rcq.json +++ b/advisories/github-reviewed/2024/07/GHSA-xrh7-2gfq-4rcq/GHSA-xrh7-2gfq-4rcq.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-xrh7-2gfq-4rcq", - "modified": "2024-11-18T16:26:53Z", + "modified": "2024-12-18T22:03:16Z", "published": "2024-07-17T21:31:38Z", "aliases": [ - "CVE-2024-40420" + "CVE-2024-36694" ], "summary": "openCart Server-Side Template Injection (SSTI) vulnerability", - "details": "A Server-Side Template Injection (SSTI) vulnerability in the edit theme function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload.", + "details": "A Server-Side Template Injection (SSTI) vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload.", "severity": [ { "type": "CVSS_V3", @@ -42,7 +42,11 @@ "references": [ { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40420" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36694" + }, + { + "type": "WEB", + "url": "https://github.com/opencart/opencart/issues/13863" }, { "type": "WEB", @@ -51,6 +55,14 @@ { "type": "PACKAGE", "url": "https://github.com/opencart/opencart" + }, + { + "type": "WEB", + "url": "https://github.com/opencart/opencart/releases/tag/4.0.2.3" + }, + { + "type": "WEB", + "url": "https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/12/GHSA-j2v2-3784-vr44/GHSA-j2v2-3784-vr44.json b/advisories/github-reviewed/2024/12/GHSA-j2v2-3784-vr44/GHSA-j2v2-3784-vr44.json new file mode 100644 index 00000000000..20d7a109245 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-j2v2-3784-vr44/GHSA-j2v2-3784-vr44.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2v2-3784-vr44", + "modified": "2024-12-18T22:02:19Z", + "published": "2024-12-18T21:30:56Z", + "withdrawn": "2024-12-18T22:02:19Z", + "aliases": [], + "summary": "Duplicate Advisory: openCart Server-Side Template Injection (SSTI) vulnerability", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xrh7-2gfq-4rcq. This link is maintained to preserve external references.\n\n## Original Description\nOpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "opencart/opencart" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.0.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36694" + }, + { + "type": "WEB", + "url": "https://github.com/opencart/opencart/issues/13863" + }, + { + "type": "WEB", + "url": "https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md" + }, + { + "type": "WEB", + "url": "https://github.com/opencart/opencart/releases/tag/4.0.2.3" + }, + { + "type": "WEB", + "url": "https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-18T22:02:19Z", + "nvd_published_at": "2024-12-18T20:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-j2v2-3784-vr44/GHSA-j2v2-3784-vr44.json b/advisories/unreviewed/2024/12/GHSA-j2v2-3784-vr44/GHSA-j2v2-3784-vr44.json deleted file mode 100644 index de8e7ead7c0..00000000000 --- a/advisories/unreviewed/2024/12/GHSA-j2v2-3784-vr44/GHSA-j2v2-3784-vr44.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-j2v2-3784-vr44", - "modified": "2024-12-18T21:30:56Z", - "published": "2024-12-18T21:30:56Z", - "aliases": [ - "CVE-2024-36694" - ], - "details": "OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36694" - }, - { - "type": "WEB", - "url": "https://github.com/opencart/opencart/issues/13863" - }, - { - "type": "WEB", - "url": "https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md" - }, - { - "type": "WEB", - "url": "https://github.com/opencart/opencart/releases/tag/4.0.2.3" - }, - { - "type": "WEB", - "url": "https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-12-18T20:15:22Z" - } -} \ No newline at end of file