Publish Advisories

GHSA-j2wh-wrv3-4x4g GHSA-f73w-4m7g-ch9x GHSA-hmg4-wwm5-p999 GHSA-wv8v-rmw2-25wc GHSA-rr6p-3pfg-562j
2026-05-22 18:04:22 -07:00 · 2025-02-20 22:54:00 +00:00
parent 19166f1519
commit 813a6f1faa
5 changed files with 28 additions and 15 deletions
@@ -1,9 +1,11 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j2wh-wrv3-4x4g",
-  "modified": "2023-02-16T18:41:07Z",
+  "modified": "2025-02-20T22:51:27Z",
  "published": "2023-02-16T18:41:07Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-27098"
+  ],
  "summary": "Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler",
  "details": "### Summary\nMissing check vulnerability in the static file handler allows any client to access the files in the server's file system\n\n### Details\nWhen `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`;\n\n```ts\n  if (staticFiles) {\n    router.get('/:relativePath+', async request => {\n      let { relativePath } = request.params;\n      if (!relativePath) {\n        relativePath = 'index.html';\n      }\n      const absolutePath = path.join(baseDir, staticFiles, relativePath);\n      if (absolutePath.includes(staticFiles) && (await pathExists(absolutePath))) {\n        const readStream = fs.createReadStream(absolutePath);\n        return new Response(readStream as any, {\n          status: 200,\n        });\n      }\n      return undefined;\n    });\n ```\n\n### Example scenario\nTo reproduce it, set `staticFiles` to the relative path of a directory in `.meshrc.yml`;\n\n```yml\nserve:\n   staticFiles: ./public\n```\n\nThen start the server with `mesh dev`, and browse to `/..%2fpackage.json` then you will see the content of `package.json`. You can even go deeper to see sensitive data; `/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd`\n\n### Impact and solution\nIf `staticFiles` is set under `serve` in the configuration file. you have two options to fix vulnerability;\n\n- Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18`\n- Remove `staticFiles` option from the configuration, and use other solutions to serve static files.\n\n### Credits\nThanks [alanwillms@gmail.com](mailto:alanwillms@gmail.com) for reporting this vulnerability with details",
  "severity": [
@@ -57,6 +59,14 @@
      "type": "WEB",
      "url": "https://github.com/Urigo/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27098"
+    },
    {
      "type": "WEB",
      "url": "https://github.com/Urigo/graphql-mesh/commit/95d93e7c140c2995b37e9d822aa3fe4e24ed2e78"
@@ -67,10 +77,12 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-22"
+    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-16T18:41:07Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-02-20T21:15:26Z"
  }
 }
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f73w-4m7g-ch9x",
-  "modified": "2024-09-30T16:16:15Z",
+  "modified": "2025-02-20T22:53:21Z",
  "published": "2023-09-01T18:30:41Z",
  "aliases": [
    "CVE-2023-39631"
@@ -12,10 +12,6 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
-    },
-    {
-      "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
@@ -1,13 +1,13 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hmg4-wwm5-p999",
-  "modified": "2025-01-21T21:21:30Z",
+  "modified": "2025-02-20T22:51:41Z",
  "published": "2025-01-21T21:21:30Z",
  "aliases": [
    "CVE-2025-24011"
  ],
  "summary": "Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes ",
-  "details": "### Impact\n\nBased on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists.\n\n### Patches\n\nWill be patched in 14.3.2 and 15.1.2.\n\n### Workarounds\n\nNone available.\n\n",
+  "details": "### Impact\n\nBased on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists.\n\n### Patches\n\nWill be patched in 14.3.2 and 15.1.2.\n\n### Workarounds\n\nNone available.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -78,7 +78,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-203"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wv8v-rmw2-25wc",
-  "modified": "2025-01-21T19:59:13Z",
+  "modified": "2025-02-20T22:51:54Z",
  "published": "2025-01-21T19:59:13Z",
  "aliases": [
    "CVE-2025-24012"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rr6p-3pfg-562j",
-  "modified": "2025-02-20T20:16:21Z",
+  "modified": "2025-02-20T22:53:32Z",
  "published": "2025-02-20T20:16:21Z",
  "aliases": [
    "CVE-2025-24893"
@@ -59,6 +59,10 @@
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j"
    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24893"
+    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40"
@@ -87,6 +91,6 @@
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-20T20:16:21Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-02-20T20:15:46Z"
  }
 }