Publish Advisories

GHSA-3rrg-p8xc-3457
GHSA-774g-r3fm-4v85
GHSA-9jrh-hch8-rr5c

advisories/github-reviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3rrg-p8xc-3457",
-  "modified": "2022-05-14T03:33:40Z",
+  "modified": "2024-01-30T22:39:03Z",
   "published": "2022-05-14T03:33:40Z",
   "aliases": [
     "CVE-2018-1000113"
   ],
+  "summary": "Stored cross-site scripting vulnerability in Jenkins TestLink Plugin",
   "details": "A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript",
   "severity": [
     {
@@ -14,7 +15,28 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:testlink"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.13"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.12"
+      }
+    }
   ],
   "references": [
     {
@@ -31,8 +53,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T22:39:03Z",
     "nvd_published_at": "2018-03-13T13:29:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-774g-r3fm-4v85",
-  "modified": "2022-05-17T00:29:02Z",
+  "modified": "2024-01-30T22:39:23Z",
   "published": "2022-05-17T00:29:02Z",
   "aliases": [
     "CVE-2017-1000090"
   ],
+  "summary": "CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration",
   "details": "Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:role-strategy"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.5.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -31,8 +50,8 @@
       "CWE-352"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T22:39:23Z",
     "nvd_published_at": "2017-10-05T01:29:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9jrh-hch8-rr5c",
-  "modified": "2022-05-14T03:23:41Z",
+  "modified": "2024-01-30T22:38:38Z",
   "published": "2022-05-14T03:23:41Z",
   "aliases": [
     "CVE-2018-1000148"
   ],
+  "summary": "Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system ",
   "details": "An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows attackers with permission to configure jobs to read arbitrary files from the Jenkins master file system.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:copy-to-slave"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.4.4"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -31,8 +50,8 @@
       "CWE-200"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T22:38:38Z",
     "nvd_published_at": "2018-04-05T13:29:00Z"
   }
 }