diff --git a/advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json b/advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json index 0ebcb78d16f..6a52dc89506 100644 --- a/advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json +++ b/advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json @@ -1,14 +1,23 @@ { "schema_version": "1.4.0", "id": "GHSA-g8v9-c8m3-942v", - "modified": "2024-10-24T21:45:54Z", + "modified": "2024-12-19T20:17:18Z", "published": "2024-10-24T18:30:44Z", "aliases": [ "CVE-2024-48514" ], "summary": "Remote code execution in php-heic-to-jpg", - "details": "php-heic-to-jpg <= 1.0.5 is vulnerable to remote code execution. An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below.", - "severity": [], + "details": "php-heic-to-jpg < 1.0.5 is vulnerable to remote code execution. An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg below 1.0.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], "affected": [ { "package": { @@ -39,10 +48,18 @@ "type": "WEB", "url": "https://github.com/MaestroError/php-heic-to-jpg/pull/34" }, + { + "type": "WEB", + "url": "https://advisories.gitlab.com/pkg/composer/maestroerror/php-heic-to-jpg/CVE-2024-48514" + }, { "type": "PACKAGE", "url": "https://github.com/MaestroError/php-heic-to-jpg" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-g8v9-c8m3-942v" + }, { "type": "WEB", "url": "https://github.com/marcoris/CVEs/tree/master/CVE-2024-48514"