Publish Advisories

GHSA-6fg4-36v7-xv32
GHSA-w97x-j6rg-55v5
GHSA-x25h-f84x-wh4m

advisories/github-reviewed/2022/03/GHSA-6fg4-36v7-xv32/GHSA-6fg4-36v7-xv32.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6fg4-36v7-xv32",
-  "modified": "2022-11-30T20:39:49Z",
+  "modified": "2023-10-27T16:59:13Z",
   "published": "2022-03-16T00:00:45Z",
   "aliases": [
     "CVE-2022-27197"
@@ -11,7 +11,7 @@
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
     }
   ],
   "affected": [
@@ -61,7 +61,7 @@
     "cwe_ids": [
       "CWE-79"
     ],
-    "severity": "HIGH",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2022-11-30T20:39:49Z",
     "nvd_published_at": "2022-03-15T17:15:00Z"

advisories/github-reviewed/2022/03/GHSA-w97x-j6rg-55v5/GHSA-w97x-j6rg-55v5.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w97x-j6rg-55v5",
-  "modified": "2022-11-29T22:57:53Z",
+  "modified": "2023-10-27T16:59:57Z",
   "published": "2022-03-30T00:00:25Z",
   "aliases": [
     "CVE-2022-28141"
@@ -11,7 +11,7 @@
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
     }
   ],
   "affected": [
@@ -57,7 +57,7 @@
     "cwe_ids": [
       "CWE-522"
     ],
-    "severity": "LOW",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2022-11-29T22:57:53Z",
     "nvd_published_at": "2022-03-29T13:15:00Z"

advisories/github-reviewed/2022/03/GHSA-x25h-f84x-wh4m/GHSA-x25h-f84x-wh4m.json

@@ -1,17 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x25h-f84x-wh4m",
-  "modified": "2023-10-02T16:32:31Z",
+  "modified": "2023-10-27T17:00:43Z",
   "published": "2022-03-30T00:00:25Z",
   "aliases": [
     "CVE-2022-28138"
   ],
   "summary": "CSRF vulnerability in Jenkins RocketChat Notifier Plugin",
-  "details": "Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.\n\nAdditionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nRocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.",
+  "details": "Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential.\n\nAdditionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nRocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.",
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
     }
   ],
   "affected": [
@@ -20,11 +20,6 @@
         "ecosystem": "Maven",
         "name": "org.jenkins-ci.plugins:rocketchatnotifier"
       },
-      "ecosystem_specific": {
-        "affected_functions": [
-          ""
-        ]
-      },
       "ranges": [
         {
           "type": "ECOSYSTEM",