From 66021af2c6052b585fd306c8644022a9833190a2 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 21 Dec 2023 13:51:12 +0000
Subject: [PATCH] Publish Advisories

GHSA-42mm-x828-56c7
GHSA-jm4g-8rvq-v87j
---
 .../05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json    |  4 ++++
 .../05/GHSA-jm4g-8rvq-v87j/GHSA-jm4g-8rvq-v87j.json    | 10 +++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2022/05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json b/advisories/github-reviewed/2022/05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json
index a3a5db4d97b..f3a70e9183c 100644
--- a/advisories/github-reviewed/2022/05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json
+++ b/advisories/github-reviewed/2022/05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json
@@ -43,6 +43,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21617"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/configurationslicing-plugin/commit/b22b82df3654e8379466a51de4391884aa4d6156"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/jenkinsci/configurationslicing-plugin"
diff --git a/advisories/github-reviewed/2022/05/GHSA-jm4g-8rvq-v87j/GHSA-jm4g-8rvq-v87j.json b/advisories/github-reviewed/2022/05/GHSA-jm4g-8rvq-v87j/GHSA-jm4g-8rvq-v87j.json
index cca818ef8ab..262ce23d275 100644
--- a/advisories/github-reviewed/2022/05/GHSA-jm4g-8rvq-v87j/GHSA-jm4g-8rvq-v87j.json
+++ b/advisories/github-reviewed/2022/05/GHSA-jm4g-8rvq-v87j/GHSA-jm4g-8rvq-v87j.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jm4g-8rvq-v87j",
-  "modified": "2023-10-27T15:11:38Z",
+  "modified": "2023-12-21T13:49:53Z",
   "published": "2022-05-24T19:04:53Z",
   "aliases": [
     "CVE-2021-21664"
   ],
-  "summary": "Missing permission check in XebiaLabs XL Deploy Plugin allows capturing credentials",
-  "details": "An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.",
+  "summary": "Incorrect permission check in XebiaLabs XL Deploy Plugin allows capturing credentials",
+  "details": "An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.\n\nThe permission check was partially fixed in XebiaLabs XL Deploy Plugin 7.5.9: A permission check was added, but for the wrong permission, still allowing some non-admin users to access the form validation method.\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -43,6 +43,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21664"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/xldeploy-plugin/commit/79ae204d2ee6cd94badf4c24a150cee13a3bde44"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/jenkinsci/xldeploy-plugin"