diff --git a/advisories/github-reviewed/2024/07/GHSA-9xhh-3m78-gvgj/GHSA-9xhh-3m78-gvgj.json b/advisories/github-reviewed/2024/07/GHSA-9xhh-3m78-gvgj/GHSA-9xhh-3m78-gvgj.json index 8add3861490..c344ee7898e 100644 --- a/advisories/github-reviewed/2024/07/GHSA-9xhh-3m78-gvgj/GHSA-9xhh-3m78-gvgj.json +++ b/advisories/github-reviewed/2024/07/GHSA-9xhh-3m78-gvgj/GHSA-9xhh-3m78-gvgj.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-9xhh-3m78-gvgj", - "modified": "2024-08-02T16:02:37Z", + "modified": "2024-08-15T12:23:00Z", "published": "2024-07-22T18:31:48Z", "aliases": [ "CVE-2024-28698" ], "summary": "CLSA Directory Traversal vulnerability", - "details": "Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.", + "details": "Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.\n\nFixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.", "severity": [ { "type": "CVSS_V3", @@ -32,11 +32,55 @@ "introduced": "0" }, { - "fixed": "8.0.0" + "fixed": "5.5.4" } ] } ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Csla" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "8.0.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 6.2.2" + } + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Csla" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "8.0.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.0.5" + } } ], "references": [ @@ -52,10 +96,26 @@ "type": "WEB", "url": "https://github.com/MarimerLLC/csla/commit/2c32a5748a0a4bb0159285dfad61d4050e890080" }, + { + "type": "WEB", + "url": "https://github.com/MarimerLLC/csla/commit/445bc609bc117f62cabf49e1462f7a43b0f8f9a2" + }, + { + "type": "WEB", + "url": "https://github.com/MarimerLLC/csla/commit/8fbdd8c773bfeb9ba3e52d91b5a664848629b13a" + }, + { + "type": "WEB", + "url": "https://github.com/MarimerLLC/csla/commit/f3a5c3474974f60ce3c8ffbd5d91c23a1e397ea4" + }, { "type": "PACKAGE", "url": "https://github.com/MarimerLLC/csla" }, + { + "type": "WEB", + "url": "https://github.com/MarimerLLC/csla/releases/tag/v5.5.4" + }, { "type": "WEB", "url": "https://www.intruder.io/research/path-traversal-and-code-execution-in-csla-net-cve-2024-28698"