From 813a6f1faafb156ea6f5d0f62a938ba5d0b6b6b0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Feb 2025 22:54:00 +0000 Subject: [PATCH] Publish Advisories GHSA-j2wh-wrv3-4x4g GHSA-f73w-4m7g-ch9x GHSA-hmg4-wwm5-p999 GHSA-wv8v-rmw2-25wc GHSA-rr6p-3pfg-562j --- .../GHSA-j2wh-wrv3-4x4g.json | 20 +++++++++++++++---- .../GHSA-f73w-4m7g-ch9x.json | 6 +----- .../GHSA-hmg4-wwm5-p999.json | 7 ++++--- .../GHSA-wv8v-rmw2-25wc.json | 2 +- .../GHSA-rr6p-3pfg-562j.json | 8 ++++++-- 5 files changed, 28 insertions(+), 15 deletions(-) diff --git a/advisories/github-reviewed/2023/02/GHSA-j2wh-wrv3-4x4g/GHSA-j2wh-wrv3-4x4g.json b/advisories/github-reviewed/2023/02/GHSA-j2wh-wrv3-4x4g/GHSA-j2wh-wrv3-4x4g.json index 496745e07f4..a799d36a0b0 100644 --- a/advisories/github-reviewed/2023/02/GHSA-j2wh-wrv3-4x4g/GHSA-j2wh-wrv3-4x4g.json +++ b/advisories/github-reviewed/2023/02/GHSA-j2wh-wrv3-4x4g/GHSA-j2wh-wrv3-4x4g.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-j2wh-wrv3-4x4g", - "modified": "2023-02-16T18:41:07Z", + "modified": "2025-02-20T22:51:27Z", "published": "2023-02-16T18:41:07Z", - "aliases": [], + "aliases": [ + "CVE-2025-27098" + ], "summary": "Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler", "details": "### Summary\nMissing check vulnerability in the static file handler allows any client to access the files in the server's file system\n\n### Details\nWhen `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`;\n\n```ts\n if (staticFiles) {\n router.get('/:relativePath+', async request => {\n let { relativePath } = request.params;\n if (!relativePath) {\n relativePath = 'index.html';\n }\n const absolutePath = path.join(baseDir, staticFiles, relativePath);\n if (absolutePath.includes(staticFiles) && (await pathExists(absolutePath))) {\n const readStream = fs.createReadStream(absolutePath);\n return new Response(readStream as any, {\n status: 200,\n });\n }\n return undefined;\n });\n ```\n\n### Example scenario\nTo reproduce it, set `staticFiles` to the relative path of a directory in `.meshrc.yml`;\n\n```yml\nserve:\n staticFiles: ./public\n```\n\nThen start the server with `mesh dev`, and browse to `/..%2fpackage.json` then you will see the content of `package.json`. You can even go deeper to see sensitive data; `/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd`\n\n### Impact and solution\nIf `staticFiles` is set under `serve` in the configuration file. you have two options to fix vulnerability;\n\n- Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18`\n- Remove `staticFiles` option from the configuration, and use other solutions to serve static files.\n\n### Credits\nThanks [alanwillms@gmail.com](mailto:alanwillms@gmail.com) for reporting this vulnerability with details", "severity": [ @@ -57,6 +59,14 @@ "type": "WEB", "url": "https://github.com/Urigo/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g" }, + { + "type": "WEB", + "url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27098" + }, { "type": "WEB", "url": "https://github.com/Urigo/graphql-mesh/commit/95d93e7c140c2995b37e9d822aa3fe4e24ed2e78" @@ -67,10 +77,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-22" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-02-16T18:41:07Z", - "nvd_published_at": null + "nvd_published_at": "2025-02-20T21:15:26Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/09/GHSA-f73w-4m7g-ch9x/GHSA-f73w-4m7g-ch9x.json b/advisories/github-reviewed/2023/09/GHSA-f73w-4m7g-ch9x/GHSA-f73w-4m7g-ch9x.json index e229ad3321d..7c46904bc14 100644 --- a/advisories/github-reviewed/2023/09/GHSA-f73w-4m7g-ch9x/GHSA-f73w-4m7g-ch9x.json +++ b/advisories/github-reviewed/2023/09/GHSA-f73w-4m7g-ch9x/GHSA-f73w-4m7g-ch9x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f73w-4m7g-ch9x", - "modified": "2024-09-30T16:16:15Z", + "modified": "2025-02-20T22:53:21Z", "published": "2023-09-01T18:30:41Z", "aliases": [ "CVE-2023-39631" @@ -12,10 +12,6 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - }, - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ diff --git a/advisories/github-reviewed/2025/01/GHSA-hmg4-wwm5-p999/GHSA-hmg4-wwm5-p999.json b/advisories/github-reviewed/2025/01/GHSA-hmg4-wwm5-p999/GHSA-hmg4-wwm5-p999.json index 76e25e298db..0bb6c7bfc6f 100644 --- a/advisories/github-reviewed/2025/01/GHSA-hmg4-wwm5-p999/GHSA-hmg4-wwm5-p999.json +++ b/advisories/github-reviewed/2025/01/GHSA-hmg4-wwm5-p999/GHSA-hmg4-wwm5-p999.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-hmg4-wwm5-p999", - "modified": "2025-01-21T21:21:30Z", + "modified": "2025-02-20T22:51:41Z", "published": "2025-01-21T21:21:30Z", "aliases": [ "CVE-2025-24011" ], "summary": "Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes ", - "details": "### Impact\n\nBased on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists.\n\n### Patches\n\nWill be patched in 14.3.2 and 15.1.2.\n\n### Workarounds\n\nNone available.\n\n", + "details": "### Impact\n\nBased on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists.\n\n### Patches\n\nWill be patched in 14.3.2 and 15.1.2.\n\n### Workarounds\n\nNone available.", "severity": [ { "type": "CVSS_V3", @@ -78,7 +78,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-203" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2025/01/GHSA-wv8v-rmw2-25wc/GHSA-wv8v-rmw2-25wc.json b/advisories/github-reviewed/2025/01/GHSA-wv8v-rmw2-25wc/GHSA-wv8v-rmw2-25wc.json index 4706890967c..27c9e47617c 100644 --- a/advisories/github-reviewed/2025/01/GHSA-wv8v-rmw2-25wc/GHSA-wv8v-rmw2-25wc.json +++ b/advisories/github-reviewed/2025/01/GHSA-wv8v-rmw2-25wc/GHSA-wv8v-rmw2-25wc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wv8v-rmw2-25wc", - "modified": "2025-01-21T19:59:13Z", + "modified": "2025-02-20T22:51:54Z", "published": "2025-01-21T19:59:13Z", "aliases": [ "CVE-2025-24012" diff --git a/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json b/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json index dad5d71db92..64990d34040 100644 --- a/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json +++ b/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rr6p-3pfg-562j", - "modified": "2025-02-20T20:16:21Z", + "modified": "2025-02-20T22:53:32Z", "published": "2025-02-20T20:16:21Z", "aliases": [ "CVE-2025-24893" @@ -59,6 +59,10 @@ "type": "WEB", "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24893" + }, { "type": "WEB", "url": "https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40" @@ -87,6 +91,6 @@ "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2025-02-20T20:16:21Z", - "nvd_published_at": null + "nvd_published_at": "2025-02-20T20:15:46Z" } } \ No newline at end of file