From 6e114f723927aa49d98f84b748d4aef9a82868ea Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 11 Oct 2024 20:54:52 +0000
Subject: [PATCH] Publish Advisories

GHSA-77hv-8796-8ccp
GHSA-879r-7f3w-8jj3
---
 .../GHSA-77hv-8796-8ccp.json                  | 21 +++++++++++++---
 .../GHSA-879r-7f3w-8jj3.json                  | 25 +++++++++++++++----
 2 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/advisories/github-reviewed/2018/07/GHSA-77hv-8796-8ccp/GHSA-77hv-8796-8ccp.json b/advisories/github-reviewed/2018/07/GHSA-77hv-8796-8ccp/GHSA-77hv-8796-8ccp.json
index 7b27c8a7155..5fb84931c07 100644
--- a/advisories/github-reviewed/2018/07/GHSA-77hv-8796-8ccp/GHSA-77hv-8796-8ccp.json
+++ b/advisories/github-reviewed/2018/07/GHSA-77hv-8796-8ccp/GHSA-77hv-8796-8ccp.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-77hv-8796-8ccp",
-  "modified": "2023-02-03T20:31:42Z",
+  "modified": "2024-10-11T20:53:34Z",
   "published": "2018-07-23T19:51:50Z",
   "aliases": [
     "CVE-2012-5486"
@@ -9,7 +9,14 @@
   "summary": "HTTP header injection in Plone and Zope2",
   "details": "ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -98,6 +105,14 @@
       "type": "ADVISORY",
       "url": "https://github.com/advisories/GHSA-77hv-8796-8ccp"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-28.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-73.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://plone.org/products/plone-hotfix/releases/20121106"
@@ -119,7 +134,7 @@
     "cwe_ids": [
 
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2020-06-16T21:21:53Z",
     "nvd_published_at": "2014-09-30T14:55:00Z"
diff --git a/advisories/github-reviewed/2018/07/GHSA-879r-7f3w-8jj3/GHSA-879r-7f3w-8jj3.json b/advisories/github-reviewed/2018/07/GHSA-879r-7f3w-8jj3/GHSA-879r-7f3w-8jj3.json
index 61c92866c52..325cfa80a64 100644
--- a/advisories/github-reviewed/2018/07/GHSA-879r-7f3w-8jj3/GHSA-879r-7f3w-8jj3.json
+++ b/advisories/github-reviewed/2018/07/GHSA-879r-7f3w-8jj3/GHSA-879r-7f3w-8jj3.json
@@ -1,15 +1,22 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-879r-7f3w-8jj3",
-  "modified": "2020-06-16T21:24:39Z",
+  "modified": "2024-10-11T20:52:23Z",
   "published": "2018-07-23T19:52:06Z",
   "aliases": [
     "CVE-2012-5489"
   ],
-  "summary": "Moderate severity vulnerability that affects Plone and Zope2",
+  "summary": "Plone and Zope2 vulnerable to unauthorized access to restricted attributes",
   "details": "The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -109,6 +116,14 @@
       "type": "WEB",
       "url": "https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-31.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-74.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://plone.org/products/plone-hotfix/releases/20121106"
@@ -124,9 +139,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-863"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2020-06-16T21:24:39Z",
     "nvd_published_at": null