From 7f1bbfd20c4995b1689702766d034590ec026f2f Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 27 Oct 2023 14:42:32 +0000
Subject: [PATCH] Publish Advisories

GHSA-34j5-c4cv-mmg5
GHSA-xqpp-26pp-2365
---
 .../2022/05/GHSA-34j5-c4cv-mmg5/GHSA-34j5-c4cv-mmg5.json  | 6 +++---
 .../2022/05/GHSA-xqpp-26pp-2365/GHSA-xqpp-26pp-2365.json  | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/advisories/github-reviewed/2022/05/GHSA-34j5-c4cv-mmg5/GHSA-34j5-c4cv-mmg5.json b/advisories/github-reviewed/2022/05/GHSA-34j5-c4cv-mmg5/GHSA-34j5-c4cv-mmg5.json
index 4ef4f9400cb..9e1c5cd73f3 100644
--- a/advisories/github-reviewed/2022/05/GHSA-34j5-c4cv-mmg5/GHSA-34j5-c4cv-mmg5.json
+++ b/advisories/github-reviewed/2022/05/GHSA-34j5-c4cv-mmg5/GHSA-34j5-c4cv-mmg5.json
@@ -1,17 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-34j5-c4cv-mmg5",
-  "modified": "2022-12-15T17:33:55Z",
+  "modified": "2023-10-27T14:41:43Z",
   "published": "2022-05-24T19:03:11Z",
   "aliases": [
     "CVE-2021-21659"
   ],
   "summary": "XXE vulnerability in Jenkins URLTrigger Plugin",
-  "details": "URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.\n\nURLTrigger Plugin 0.49 disables external entity resolution for its XML parser.",
+  "details": "Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.\n\nUJenkins RLTrigger Plugin 0.49 disables external entity resolution for its XML parser.",
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
     }
   ],
   "affected": [
diff --git a/advisories/github-reviewed/2022/05/GHSA-xqpp-26pp-2365/GHSA-xqpp-26pp-2365.json b/advisories/github-reviewed/2022/05/GHSA-xqpp-26pp-2365/GHSA-xqpp-26pp-2365.json
index 494aa68d027..7dda604702f 100644
--- a/advisories/github-reviewed/2022/05/GHSA-xqpp-26pp-2365/GHSA-xqpp-26pp-2365.json
+++ b/advisories/github-reviewed/2022/05/GHSA-xqpp-26pp-2365/GHSA-xqpp-26pp-2365.json
@@ -1,17 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xqpp-26pp-2365",
-  "modified": "2022-12-15T17:32:32Z",
+  "modified": "2023-10-27T14:40:44Z",
   "published": "2022-05-24T19:03:11Z",
   "aliases": [
     "CVE-2021-21660"
   ],
   "summary": "XSS vulnerability in Jenkins Markdown Formatter Plugin",
-  "details": "Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.\n\nMarkdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.",
+  "details": "Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.\n\nJenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.",
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
     }
   ],
   "affected": [
@@ -64,7 +64,7 @@
     "cwe_ids": [
       "CWE-79"
     ],
-    "severity": "HIGH",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2022-12-15T17:32:32Z",
     "nvd_published_at": "2021-05-25T17:15:00Z"