diff --git a/advisories/unreviewed/2024/06/GHSA-v2xm-76pq-phcf/GHSA-v2xm-76pq-phcf.json b/advisories/github-reviewed/2024/06/GHSA-v2xm-76pq-phcf/GHSA-v2xm-76pq-phcf.json similarity index 53% rename from advisories/unreviewed/2024/06/GHSA-v2xm-76pq-phcf/GHSA-v2xm-76pq-phcf.json rename to advisories/github-reviewed/2024/06/GHSA-v2xm-76pq-phcf/GHSA-v2xm-76pq-phcf.json index 16521d307e3..1aaf49ce2bc 100644 --- a/advisories/unreviewed/2024/06/GHSA-v2xm-76pq-phcf/GHSA-v2xm-76pq-phcf.json +++ b/advisories/github-reviewed/2024/06/GHSA-v2xm-76pq-phcf/GHSA-v2xm-76pq-phcf.json @@ -1,17 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-v2xm-76pq-phcf", - "modified": "2024-06-21T06:31:12Z", + "modified": "2024-06-21T15:06:26Z", "published": "2024-06-21T06:31:12Z", "aliases": [ "CVE-2021-47621" ], + "summary": "ClassGraph XML External Entity Reference", "details": "ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "io.github.classgraph:classgraph" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.8.112" + } + ] + } + ] + } ], "references": [ { @@ -30,6 +56,10 @@ "type": "WEB", "url": "https://docs.r3.com/en/platform/corda/4.8/enterprise/release-notes-enterprise.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/classgraph/classgraph" + }, { "type": "WEB", "url": "https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.112" @@ -37,11 +67,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-611" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-21T15:06:26Z", "nvd_published_at": "2024-06-21T06:15:10Z" } } \ No newline at end of file