Publish Advisories

GHSA-g82w-58jf-gcxx GHSA-65wh-g8x8-gm2h GHSA-wm7r-3qxj-5xgq GHSA-x2w4-c67p-g44j
2026-05-22 18:04:22 -07:00 · 2025-02-13 18:57:38 +00:00
parent 57299b5607
commit 6c36465497
4 changed files with 6 additions and 6 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g82w-58jf-gcxx",
-  "modified": "2023-06-07T16:04:02Z",
+  "modified": "2025-02-13T18:57:13Z",
  "published": "2023-05-26T13:59:19Z",
  "aliases": [
    "CVE-2023-2878"
@@ -1,13 +1,13 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-65wh-g8x8-gm2h",
-  "modified": "2024-10-14T14:12:13Z",
+  "modified": "2025-02-13T18:57:09Z",
  "published": "2023-06-12T18:30:18Z",
  "aliases": [
    "CVE-2023-34212"
  ],
  "summary": "Apache NiFi vulnerable to Deserialization of Untrusted Data",
-  "details": "The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.\n\nThe resolution validates the JNDI URL and restricts locations to a set of allowed schemes.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.\n\n\n",
+  "details": "The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.\n\nThe resolution validates the JNDI URL and restricts locations to a set of allowed schemes.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -1,12 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wm7r-3qxj-5xgq",
-  "modified": "2023-06-09T22:54:42Z",
+  "modified": "2025-02-13T18:57:03Z",
  "published": "2023-06-06T21:30:18Z",
  "withdrawn": "2023-06-09T22:54:42Z",
  "aliases": [],
  "summary": "Duplicate Advisory: Grafana Improper Access Control vulnerability",
-  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references.\n\n## Original Description\nGrafana is an open-source platform for monitoring and observability. \n\nThe option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.\n\nThis might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.\n\nUsers may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.\n\n",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references.\n\n## Original Description\nGrafana is an open-source platform for monitoring and observability. \n\nThe option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.\n\nThis might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.\n\nUsers may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-x2w4-c67p-g44j",
-  "modified": "2023-06-07T15:08:08Z",
+  "modified": "2025-02-13T18:56:29Z",
  "published": "2023-06-06T21:30:18Z",
  "aliases": [
    "CVE-2023-2801"