diff --git a/advisories/unreviewed/2024/02/GHSA-49w7-5r33-jm9m/GHSA-49w7-5r33-jm9m.json b/advisories/github-reviewed/2024/02/GHSA-49w7-5r33-jm9m/GHSA-49w7-5r33-jm9m.json similarity index 59% rename from advisories/unreviewed/2024/02/GHSA-49w7-5r33-jm9m/GHSA-49w7-5r33-jm9m.json rename to advisories/github-reviewed/2024/02/GHSA-49w7-5r33-jm9m/GHSA-49w7-5r33-jm9m.json index 7c3388f21d0..70032ad3de9 100644 --- a/advisories/unreviewed/2024/02/GHSA-49w7-5r33-jm9m/GHSA-49w7-5r33-jm9m.json +++ b/advisories/github-reviewed/2024/02/GHSA-49w7-5r33-jm9m/GHSA-49w7-5r33-jm9m.json @@ -1,27 +1,54 @@ { "schema_version": "1.4.0", "id": "GHSA-49w7-5r33-jm9m", - "modified": "2024-02-29T03:33:18Z", + "modified": "2024-02-29T20:11:38Z", "published": "2024-02-29T03:33:18Z", "aliases": [ "CVE-2024-25712" ], + "summary": "http-swagger XSS via PUT requests", "details": "http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/swaggo/http-swagger" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.6" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25712" }, + { + "type": "WEB", + "url": "https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e" + }, { "type": "WEB", "url": "https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/swaggo/http-swagger" + }, { "type": "WEB", "url": "https://github.com/swaggo/http-swagger/releases/tag/v1.2.6" @@ -31,9 +58,9 @@ "cwe_ids": [ ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:11:38Z", "nvd_published_at": "2024-02-29T01:44:16Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-v4cp-2q7v-hg9q/GHSA-v4cp-2q7v-hg9q.json b/advisories/github-reviewed/2024/02/GHSA-v4cp-2q7v-hg9q/GHSA-v4cp-2q7v-hg9q.json new file mode 100644 index 00000000000..0f0bd6869b6 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-v4cp-2q7v-hg9q/GHSA-v4cp-2q7v-hg9q.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v4cp-2q7v-hg9q", + "modified": "2024-02-29T20:11:45Z", + "published": "2024-02-29T03:33:18Z", + "aliases": [ + "CVE-2024-27516" + ], + "summary": "livehelperchat Server-Side Template Injection", + "details": "livehelperchat 4.28v is vulnerable to Server-Side Template Injection (SSTI).", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "remdex/livehelperchat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.29" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27516" + }, + { + "type": "WEB", + "url": "https://github.com/LiveHelperChat/livehelperchat/issues/2054" + }, + { + "type": "WEB", + "url": "https://github.com/LiveHelperChat/livehelperchat/commit/a61d231526a36d4a7d8cc957914799ee1f9db0ab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/LiveHelperChat/livehelperchat" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:11:45Z", + "nvd_published_at": "2024-02-29T01:44:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-v4cp-2q7v-hg9q/GHSA-v4cp-2q7v-hg9q.json b/advisories/unreviewed/2024/02/GHSA-v4cp-2q7v-hg9q/GHSA-v4cp-2q7v-hg9q.json deleted file mode 100644 index 03ad85cdc82..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-v4cp-2q7v-hg9q/GHSA-v4cp-2q7v-hg9q.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v4cp-2q7v-hg9q", - "modified": "2024-02-29T03:33:18Z", - "published": "2024-02-29T03:33:18Z", - "aliases": [ - "CVE-2024-27516" - ], - "details": "livehelperchat 4.28v is vulnerable to Server-Side Template Injection (SSTI).", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27516" - }, - { - "type": "WEB", - "url": "https://github.com/LiveHelperChat/livehelperchat/issues/2054" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T01:44:20Z" - } -} \ No newline at end of file