From 80a65e7be1c614ee9191a4fc46b0691c4fdd3123 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 11 Jul 2023 22:48:01 +0000 Subject: [PATCH] Publish Advisories GHSA-469h-mqg8-535r GHSA-5652-92r9-3fx9 GHSA-f44m-65h3-99vc GHSA-h9wq-xcqx-mqxm GHSA-jm79-9pm4-vrw9 GHSA-jx3q-5rgf-vrrr GHSA-ph6g-p72v-pc3p GHSA-jx3q-5rgf-vrrr --- .../GHSA-469h-mqg8-535r.json | 126 ++++++++++++++++++ .../GHSA-5652-92r9-3fx9.json | 126 ++++++++++++++++++ .../GHSA-f44m-65h3-99vc.json | 35 ++++- .../GHSA-h9wq-xcqx-mqxm.json | 58 ++++++++ .../GHSA-jm79-9pm4-vrw9.json | 88 ++++++++++++ .../GHSA-jx3q-5rgf-vrrr.json | 62 +++++++++ .../GHSA-ph6g-p72v-pc3p.json | 65 +++++++++ .../GHSA-jx3q-5rgf-vrrr.json | 35 ----- 8 files changed, 556 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2023/07/GHSA-469h-mqg8-535r/GHSA-469h-mqg8-535r.json create mode 100644 advisories/github-reviewed/2023/07/GHSA-5652-92r9-3fx9/GHSA-5652-92r9-3fx9.json rename advisories/{unreviewed => github-reviewed}/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json (55%) create mode 100644 advisories/github-reviewed/2023/07/GHSA-h9wq-xcqx-mqxm/GHSA-h9wq-xcqx-mqxm.json create mode 100644 advisories/github-reviewed/2023/07/GHSA-jm79-9pm4-vrw9/GHSA-jm79-9pm4-vrw9.json create mode 100644 advisories/github-reviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json create mode 100644 advisories/github-reviewed/2023/07/GHSA-ph6g-p72v-pc3p/GHSA-ph6g-p72v-pc3p.json delete mode 100644 advisories/unreviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json diff --git a/advisories/github-reviewed/2023/07/GHSA-469h-mqg8-535r/GHSA-469h-mqg8-535r.json b/advisories/github-reviewed/2023/07/GHSA-469h-mqg8-535r/GHSA-469h-mqg8-535r.json new file mode 100644 index 00000000000..4e9bc4c3572 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-469h-mqg8-535r/GHSA-469h-mqg8-535r.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-469h-mqg8-535r", + "modified": "2023-07-11T22:47:01Z", + "published": "2023-07-11T22:47:01Z", + "aliases": [ + "CVE-2023-32693" + ], + "summary": "Decidim Cross-site Scripting vulnerability in the external link redirections", + "details": "### Impact\n\nThe external link feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.\n\n### Patches\n\nThe problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.6](https://github.com/decidim/decidim/releases/tag/v0.26.6)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.25.0" + }, + { + "fixed": "0.26.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.27.0" + }, + { + "fixed": "0.27.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.25.0" + }, + { + "fixed": "0.26.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.27.0" + }, + { + "fixed": "0.27.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32693" + }, + { + "type": "PACKAGE", + "url": "https://github.com/decidim/decidim" + }, + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/releases/tag/v0.26.6" + }, + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/releases/tag/v0.27.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:47:01Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-5652-92r9-3fx9/GHSA-5652-92r9-3fx9.json b/advisories/github-reviewed/2023/07/GHSA-5652-92r9-3fx9/GHSA-5652-92r9-3fx9.json new file mode 100644 index 00000000000..294b2557718 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-5652-92r9-3fx9/GHSA-5652-92r9-3fx9.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5652-92r9-3fx9", + "modified": "2023-07-11T22:46:57Z", + "published": "2023-07-11T22:46:57Z", + "aliases": [ + "CVE-2023-34089" + ], + "summary": "Decidim Cross-site Scripting vulnerability in the processes filter", + "details": "### Impact\n\nThe processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.\n\n### Patches\n\nThe problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.6](https://github.com/decidim/decidim/releases/tag/v0.26.6)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.14.0" + }, + { + "fixed": "0.26.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.27.0" + }, + { + "fixed": "0.27.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.14.0" + }, + { + "fixed": "0.26.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.27.0" + }, + { + "fixed": "0.27.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34089" + }, + { + "type": "PACKAGE", + "url": "https://github.com/decidim/decidim" + }, + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/releases/tag/v0.26.6" + }, + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/releases/tag/v0.27.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:46:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json b/advisories/github-reviewed/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json similarity index 55% rename from advisories/unreviewed/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json rename to advisories/github-reviewed/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json index cb5dc4d5947..d4be505287c 100644 --- a/advisories/unreviewed/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json +++ b/advisories/github-reviewed/2023/07/GHSA-f44m-65h3-99vc/GHSA-f44m-65h3-99vc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-f44m-65h3-99vc", - "modified": "2023-07-11T15:31:18Z", + "modified": "2023-07-11T22:45:55Z", "published": "2023-07-11T15:31:18Z", "aliases": [ "CVE-2023-3620" ], + "summary": "tarteaucitron.js vulnerable to Cross-site Scripting", "details": "Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "tarteaucitronjs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.13.1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,14 @@ "type": "WEB", "url": "https://github.com/amauric/tarteaucitron.js/commit/c4c2fcf2b2212ce968bdcae145bb74283c441e5f" }, + { + "type": "WEB", + "url": "https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.13.1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/amauric/tarteaucitron.js" + }, { "type": "WEB", "url": "https://huntr.dev/bounties/a0fd0671-f051-4d41-8928-9b19819084c9" @@ -35,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:45:55Z", "nvd_published_at": null } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-h9wq-xcqx-mqxm/GHSA-h9wq-xcqx-mqxm.json b/advisories/github-reviewed/2023/07/GHSA-h9wq-xcqx-mqxm/GHSA-h9wq-xcqx-mqxm.json new file mode 100644 index 00000000000..dd209f6c732 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-h9wq-xcqx-mqxm/GHSA-h9wq-xcqx-mqxm.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h9wq-xcqx-mqxm", + "modified": "2023-07-11T22:46:19Z", + "published": "2023-07-11T22:46:19Z", + "aliases": [ + + ], + "summary": "Vendure Cross Site Request Forgery vulnerability impacting all API requests", + "details": "### Impact\nVendure is an e-commerce GraphQL framework with a number of APIs and different levels of\nauthorization. By default the Cookie settings are insecure, having the SameSite setting as false\nwhich results in not having one (originates from the cookie-session npm package’s default\nsettings).\n\n### Patches\nIn progress\n\n### Workarounds\nManually set the `authOptions.cookieOptions.sameSite` configuration option to `'strict'`, `'lax'` or `true`.\n\n### References\n_Are there any links users can visit to find out more?_\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@vendure/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-h9wq-xcqx-mqxm" + }, + { + "type": "WEB", + "url": "https://github.com/vendure-ecommerce/vendure/commit/4a10d6785a3bf792ddf84053cdf232c205b82c81" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vendure-ecommerce/vendure" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:46:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-jm79-9pm4-vrw9/GHSA-jm79-9pm4-vrw9.json b/advisories/github-reviewed/2023/07/GHSA-jm79-9pm4-vrw9/GHSA-jm79-9pm4-vrw9.json new file mode 100644 index 00000000000..45bf54c02f5 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-jm79-9pm4-vrw9/GHSA-jm79-9pm4-vrw9.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm79-9pm4-vrw9", + "modified": "2023-07-11T22:46:51Z", + "published": "2023-07-11T22:46:51Z", + "aliases": [ + "CVE-2023-34090" + ], + "summary": "Decidim vulnerable to sensitive data disclosure", + "details": "Note: added the actual report as a [comment](https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110).\n\n### Summary\n\nDecidim, a platform for digital citizen participation, uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table).\n\n### Impact\nThis issue may lead to Sensitive Data Disclosure.\n\n### Patches\nThe problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3).\n\n### Workarounds\nDisable or unpublish all meetings components from your application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.27.0" + }, + { + "fixed": "0.27.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim-meetings" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.27.0" + }, + { + "fixed": "0.27.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9" + }, + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34090" + }, + { + "type": "PACKAGE", + "url": "https://github.com/decidim/decidim" + }, + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/releases/tag/v0.27.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:46:51Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json b/advisories/github-reviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json new file mode 100644 index 00000000000..60d42e8ae10 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx3q-5rgf-vrrr", + "modified": "2023-07-11T22:46:05Z", + "published": "2023-07-11T15:31:18Z", + "aliases": [ + "CVE-2023-37659" + ], + "summary": "xalpha vulnerable to Remote Code Execution", + "details": "xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "xalpha" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.11.4" + }, + { + "fixed": "0.11.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37659" + }, + { + "type": "WEB", + "url": "https://github.com/refraction-ray/xalpha/issues/175" + }, + { + "type": "WEB", + "url": "https://github.com/refraction-ray/xalpha/commit/6dceaa159a1a319d750ade20a4595956876657b6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/refraction-ray/xalpha" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:46:05Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-ph6g-p72v-pc3p/GHSA-ph6g-p72v-pc3p.json b/advisories/github-reviewed/2023/07/GHSA-ph6g-p72v-pc3p/GHSA-ph6g-p72v-pc3p.json new file mode 100644 index 00000000000..1b09846c2a0 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-ph6g-p72v-pc3p/GHSA-ph6g-p72v-pc3p.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph6g-p72v-pc3p", + "modified": "2023-07-11T22:46:27Z", + "published": "2023-07-11T22:46:27Z", + "aliases": [ + "CVE-2023-36825" + ], + "summary": "Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution", + "details": "### Impact\n\nThis vulnerability is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution.\n\n### Patches\n\nThe issue has been addressed in version `14.5.0`. Users are advised to upgrade their software to this version or any subsequent versions that include the patch.\n\n### Workarounds\n\nIn this case, it is recommended for users to upgrade to the patched version rather than relying on workarounds. Upgrading to the fixed version ensures that the vulnerability is no longer present and provides the best protection against remote code execution\n\n### References\n\nFor more detailed information about this workaround and its effectiveness, users should consult the support channels provided by the software or system developer. They can provide specific guidance on implementing this workaround and any potential limitations or caveats associated with it.\n\n----\n\nThis vulnerability was discovered by Vladislav Gladkiy (Positive Technologies)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "orchid/platform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.0-alpha4" + }, + { + "fixed": "14.5.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3p" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36825" + }, + { + "type": "PACKAGE", + "url": "https://github.com/orchidsoftware/platform" + }, + { + "type": "WEB", + "url": "https://github.com/orchidsoftware/platform/releases/tag/14.5.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2023-07-11T22:46:27Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json b/advisories/unreviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json deleted file mode 100644 index 74449917f6e..00000000000 --- a/advisories/unreviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jx3q-5rgf-vrrr", - "modified": "2023-07-11T15:31:18Z", - "published": "2023-07-11T15:31:18Z", - "aliases": [ - "CVE-2023-37659" - ], - "details": "xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37659" - }, - { - "type": "WEB", - "url": "https://github.com/refraction-ray/xalpha/issues/175" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file