diff --git a/advisories/unreviewed/2025/02/GHSA-wfpm-qchc-6cf9/GHSA-wfpm-qchc-6cf9.json b/advisories/github-reviewed/2025/02/GHSA-wfpm-qchc-6cf9/GHSA-wfpm-qchc-6cf9.json similarity index 56% rename from advisories/unreviewed/2025/02/GHSA-wfpm-qchc-6cf9/GHSA-wfpm-qchc-6cf9.json rename to advisories/github-reviewed/2025/02/GHSA-wfpm-qchc-6cf9/GHSA-wfpm-qchc-6cf9.json index d29cecfbe7a..2aee819271a 100644 --- a/advisories/unreviewed/2025/02/GHSA-wfpm-qchc-6cf9/GHSA-wfpm-qchc-6cf9.json +++ b/advisories/github-reviewed/2025/02/GHSA-wfpm-qchc-6cf9/GHSA-wfpm-qchc-6cf9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wfpm-qchc-6cf9", - "modified": "2025-02-08T03:31:12Z", + "modified": "2025-02-10T17:56:47Z", "published": "2025-02-08T00:32:18Z", "aliases": [ "CVE-2024-57606" ], + "summary": "SQL injection in JeecgBoot", "details": "SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the getTotalData component.", "severity": [ { @@ -13,7 +14,30 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jeecgframework.boot:jeecg-boot-common" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.7.2" + } + } + ], "references": [ { "type": "ADVISORY", @@ -29,8 +53,8 @@ "CWE-200" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-10T17:56:47Z", "nvd_published_at": "2025-02-07T22:15:13Z" } } \ No newline at end of file