diff --git a/advisories/unreviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json b/advisories/github-reviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json similarity index 57% rename from advisories/unreviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json rename to advisories/github-reviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json index 48df5068e0a..38ab940e167 100644 --- a/advisories/unreviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json +++ b/advisories/github-reviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jc55-crg7-pr35", - "modified": "2022-07-13T00:01:06Z", + "modified": "2024-04-25T20:40:45Z", "published": "2021-11-25T00:00:38Z", "aliases": [ "CVE-2021-20841" ], + "summary": "EC-CUBE Improper access control in Management screen", "details": "Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.", "severity": [ { @@ -14,13 +15,38 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.2" + }, + { + "fixed": "2.17.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.17.1" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20841" }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN75444925/index.html" @@ -35,8 +61,8 @@ "CWE-863" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T20:40:45Z", "nvd_published_at": "2021-11-24T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json b/advisories/github-reviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json new file mode 100644 index 00000000000..cfff3b0dd83 --- /dev/null +++ b/advisories/github-reviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json @@ -0,0 +1,87 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pw97-6v74-9w3p", + "modified": "2024-04-25T20:40:50Z", + "published": "2022-02-25T00:01:02Z", + "aliases": [ + "CVE-2022-25355" + ], + "summary": "EC-CUBE improperly handles HTTP Host header values", + "details": "EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "last_affected": "3.0.18-p3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.1.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.1.1" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355" + }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN53871926/index.html" + }, + { + "type": "WEB", + "url": "https://www.ec-cube.net/info/weakness/20220221" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T20:40:50Z", + "nvd_published_at": "2022-02-24T15:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json b/advisories/github-reviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json rename to advisories/github-reviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json index c9e9081508b..4162bed80af 100644 --- a/advisories/unreviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json +++ b/advisories/github-reviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fcgg-qgxg-2g2x", - "modified": "2022-05-14T01:36:14Z", + "modified": "2024-04-25T20:40:54Z", "published": "2022-05-14T01:36:14Z", "aliases": [ "CVE-2018-16191" ], + "summary": "EC-CUBE Open redirect vulnerability", "details": "Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15, EC-CUBE 3.0.16) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.", "severity": [ { @@ -14,13 +15,38 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 3.0.16" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16191" }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN25359688/index.html" @@ -39,8 +65,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T20:40:54Z", "nvd_published_at": "2019-01-09T23:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json b/advisories/github-reviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json rename to advisories/github-reviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json index 1c91db5a056..c688d0636e4 100644 --- a/advisories/unreviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json +++ b/advisories/github-reviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json @@ -1,23 +1,52 @@ { "schema_version": "1.4.0", "id": "GHSA-m9hv-qmqh-33qh", - "modified": "2022-05-24T19:21:18Z", + "modified": "2024-04-25T20:40:40Z", "published": "2022-05-24T19:21:18Z", "aliases": [ "CVE-2021-20842" ], + "summary": "EC-CUBE Cross-site request forgery (CSRF) vulnerability", "details": "Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.17.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.17.1" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20842" }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN75444925/index.html" @@ -32,8 +61,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T20:40:40Z", "nvd_published_at": "2021-11-24T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json b/advisories/github-reviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json similarity index 61% rename from advisories/unreviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json rename to advisories/github-reviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json index fa01f3b1314..917d2b63fc6 100644 --- a/advisories/unreviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json +++ b/advisories/github-reviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pggw-rqfm-72rh", - "modified": "2022-09-30T00:00:43Z", + "modified": "2024-04-25T20:41:07Z", "published": "2022-09-28T00:00:17Z", "aliases": [ "CVE-2022-38975" ], + "summary": "EC-CUBE DOM-based cross-site scripting vulnerability", "details": "DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "last_affected": "4.1.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38975" }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN21213852/index.html" @@ -35,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T20:41:07Z", "nvd_published_at": "2022-09-27T23:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json b/advisories/github-reviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json similarity index 51% rename from advisories/unreviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json rename to advisories/github-reviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json index ea9092bca6e..4ea0a1698bb 100644 --- a/advisories/unreviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json +++ b/advisories/github-reviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wjpv-frf2-3r58", - "modified": "2022-09-30T00:00:43Z", + "modified": "2024-04-25T20:40:58Z", "published": "2022-09-28T00:00:16Z", "aliases": [ "CVE-2022-40199" ], + "summary": "EC-CUBE Directory traversal vulnerability", "details": "Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.", "severity": [ { @@ -14,13 +15,54 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "last_affected": "3.0.18-p4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "last_affected": "4.1.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40199" }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN21213852/index.html" @@ -35,8 +77,8 @@ "CWE-22" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T20:40:58Z", "nvd_published_at": "2022-09-27T23:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json b/advisories/unreviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json deleted file mode 100644 index f13f8d1be49..00000000000 --- a/advisories/unreviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-pw97-6v74-9w3p", - "modified": "2023-08-08T15:31:44Z", - "published": "2022-02-25T00:01:02Z", - "aliases": [ - "CVE-2022-25355" - ], - "details": "EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355" - }, - { - "type": "WEB", - "url": "https://jvn.jp/en/jp/JVN53871926/index.html" - }, - { - "type": "WEB", - "url": "https://www.ec-cube.net/info/weakness/20220221" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-862" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-02-24T15:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4cxm-8hh5-jj33/GHSA-4cxm-8hh5-jj33.json b/advisories/unreviewed/2022/05/GHSA-4cxm-8hh5-jj33/GHSA-4cxm-8hh5-jj33.json deleted file mode 100644 index 74761349847..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-4cxm-8hh5-jj33/GHSA-4cxm-8hh5-jj33.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4cxm-8hh5-jj33", - "modified": "2022-06-29T00:00:41Z", - "published": "2022-05-24T19:06:43Z", - "aliases": [ - "CVE-2021-20778" - ], - "details": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20778" - }, - { - "type": "WEB", - "url": "https://jvn.jp/en/jp/JVN57942445/index.html" - }, - { - "type": "WEB", - "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80" - }, - { - "type": "WEB", - "url": "http://jvn.jp/en/jp/JVN57942445/index.html" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-07-01T06:15:00Z" - } -} \ No newline at end of file