From 81df82089668962d5759942941ca2bd7d20bf762 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 21 Mar 2025 17:45:03 +0000 Subject: [PATCH] Publish Advisories GHSA-6rvg-6v2m-4j46 GHSA-837q-jhwx-cmpv GHSA-9fcg-wrp8-qhr4 GHSA-r56h-j38w-hrqq GHSA-v63m-x9r9-8gqp GHSA-9fcg-wrp8-qhr4 --- .../GHSA-6rvg-6v2m-4j46.json | 35 +++- .../GHSA-837q-jhwx-cmpv.json | 100 +++++++++++ .../GHSA-9fcg-wrp8-qhr4.json | 156 ++++++++++++++++++ .../GHSA-r56h-j38w-hrqq.json | 33 +++- .../GHSA-v63m-x9r9-8gqp.json | 88 ++++++++++ .../GHSA-9fcg-wrp8-qhr4.json | 36 ---- 6 files changed, 403 insertions(+), 45 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json (66%) create mode 100644 advisories/github-reviewed/2025/03/GHSA-837q-jhwx-cmpv/GHSA-837q-jhwx-cmpv.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json (67%) create mode 100644 advisories/github-reviewed/2025/03/GHSA-v63m-x9r9-8gqp/GHSA-v63m-x9r9-8gqp.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json diff --git a/advisories/unreviewed/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json b/advisories/github-reviewed/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json similarity index 66% rename from advisories/unreviewed/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json rename to advisories/github-reviewed/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json index 7b94f2d41f6..faa13023870 100644 --- a/advisories/unreviewed/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json +++ b/advisories/github-reviewed/2025/03/GHSA-6rvg-6v2m-4j46/GHSA-6rvg-6v2m-4j46.json @@ -1,19 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-6rvg-6v2m-4j46", - "modified": "2025-03-20T12:32:43Z", + "modified": "2025-03-21T17:43:02Z", "published": "2025-03-20T12:32:43Z", "aliases": [ "CVE-2024-12720" ], - "details": "A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).", + "summary": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability", + "details": "A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.48.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf" }, + { + "type": "PACKAGE", + "url": "https://github.com/huggingface/transformers" + }, { "type": "WEB", "url": "https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98" @@ -33,8 +58,8 @@ "CWE-1333" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T17:43:02Z", "nvd_published_at": "2025-03-20T10:15:29Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-837q-jhwx-cmpv/GHSA-837q-jhwx-cmpv.json b/advisories/github-reviewed/2025/03/GHSA-837q-jhwx-cmpv/GHSA-837q-jhwx-cmpv.json new file mode 100644 index 00000000000..f036002a323 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-837q-jhwx-cmpv/GHSA-837q-jhwx-cmpv.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-837q-jhwx-cmpv", + "modified": "2025-03-21T17:42:47Z", + "published": "2025-03-21T17:42:47Z", + "aliases": [ + "CVE-2025-30168" + ], + "summary": "Parse Server has an OAuth login vulnerability", + "details": "### Impact\n\nThe 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option `auth` to configure a Parse Server authentication adapter. See the [3rd party authentication docs](https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication) for more information on which authentication providers are affected.\n\n### Patches\n\nThe fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. To accommodate a gradual rollout of the client app update, affected Parse Server authentication adapters now offer an `enableInsecureAuth` option to accept both insecure and secure payloads from clients apps. See the [3rd party authentication docs](https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication) for how to migrate from insecure to secure authentication.\n\n### Workarounds\n\nNone.\n\n### References\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv\n- Parse Server documentation for 3rd party authentication providers: https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication\n- Bug fix in Parse Server 7: https://github.com/parse-community/parse-server/pull/9668\n- Bug fix in Parse Server 8: https://github.com/parse-community/parse-server/pull/9667", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "parse-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "parse-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30168" + }, + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/pull/9667" + }, + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/pull/9668" + }, + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e" + }, + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f" + }, + { + "type": "WEB", + "url": "https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication" + }, + { + "type": "PACKAGE", + "url": "https://github.com/parse-community/parse-server" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T17:42:47Z", + "nvd_published_at": "2025-03-21T15:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json b/advisories/github-reviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json new file mode 100644 index 00000000000..c28970c25d2 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json @@ -0,0 +1,156 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9fcg-wrp8-qhr4", + "modified": "2025-03-21T17:44:22Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2565" + ], + "summary": "Liferay Portal and Liferay DXP Reveals Data via Forms", + "details": "The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.4.0" + }, + { + "fixed": "7.4.3.129" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2024.Q3.0" + }, + { + "fixed": "2024.Q3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2024.Q2.0" + }, + { + "last_affected": "2024.Q2.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2024.Q1.1" + }, + { + "fixed": "2024.Q1.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2023.Q4.0" + }, + { + "last_affected": "2023.Q4.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2023.Q3.1" + }, + { + "last_affected": "2023.Q3.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2565" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T17:44:22Z", + "nvd_published_at": "2025-03-20T17:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json b/advisories/github-reviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json similarity index 67% rename from advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json rename to advisories/github-reviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json index 8cb16ff08e9..42de0652f3d 100644 --- a/advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json +++ b/advisories/github-reviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r56h-j38w-hrqq", - "modified": "2025-03-20T21:31:46Z", + "modified": "2025-03-21T17:44:11Z", "published": "2025-03-20T18:30:30Z", "aliases": [ "CVE-2024-7598" ], + "summary": "Kubernetes kube-apiserver Vulnerable to Race Condition", "details": "A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes/cmd/kube-apiserver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.3.0" + }, + { + "last_affected": "1.32.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/kubernetes/kubernetes/issues/126587" }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/kubernetes" + }, { "type": "WEB", "url": "https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc" @@ -37,8 +62,8 @@ "CWE-362" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T17:44:11Z", "nvd_published_at": "2025-03-20T17:15:37Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-v63m-x9r9-8gqp/GHSA-v63m-x9r9-8gqp.json b/advisories/github-reviewed/2025/03/GHSA-v63m-x9r9-8gqp/GHSA-v63m-x9r9-8gqp.json new file mode 100644 index 00000000000..ccb54002905 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-v63m-x9r9-8gqp/GHSA-v63m-x9r9-8gqp.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v63m-x9r9-8gqp", + "modified": "2025-03-21T17:43:09Z", + "published": "2025-03-21T17:43:09Z", + "aliases": [ + "CVE-2025-2598" + ], + "summary": "AWS CDK CLI prints AWS credentials retrieved by custom credential plugins", + "details": "## Summary\n\nThe AWS Cloud Development Kit (AWS CDK) [1] is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. The AWS CDK CLI [2] is a command line tool for interacting with CDK applications. Customers can use the CDK CLI to create, manage, and deploy their AWS CDK projects. \n\nAn issue exists in the AWS CDK CLI where, under certain conditions, AWS credentials may be returned in the console output. Plugins that return an `expiration `property in the credentials object are affected by this issue. Plugins that omit the `expiration` property are not affected. \n\n## Impact\n\nWhen customers run AWS CDK CLI commands with credential plugins and configure those plugins to return temporary credentials by including an `expiration` property, the AWS credentials retrieved by the plugin may be returned in the console output. Any user with access where the CDK CLI was ran would have access to this output. \n\nThe following are examples of configuring a custom credential plugin: \n\n_Via command line option:_\n\n`cdk deploy --plugin /path/to/plugin`\n\n_Via configuration file [3]:_\n\n```json\n{\n \"plugin\": \"/path/to/plugin\"\n}\n```\n\nPlugins that return an `expiration` property in the credentials object, such as the following example, are affected:\n\n```console\nreturn {\n accessKeyId: '',\n secretAccessKey: '',\n sessionToken: '',\n expiration: ,\n};\n```\n\nThe `expiration` property indicates that the provided credentials are temporary. \n\nPlease refer to our \"AWS CDK CLI Library\" guide for more information about custom credential plugins [4].\n\n## Impacted versions: >=2.172.0 and <2.178.2\n\n## Patches\n\nThe issue has been addressed in version 2.178.2 [5]. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n## Workarounds\n\nIf you are unable to upgrade to version 2.178.2 or later, you can downgrade to version 2.171.1. If you are unable to downgrade, but have access to the code of the credential plugin you use, you can remove the `expiration` property from the object returned by the plugin.\n\nFor example, change the code from returning this:\n\n```javascript\nreturn {\n accessKeyId: assumeRoleOutput.Credentials.AccessKeyId,\n secretAccessKey: assumeRoleOutput.Credentials.SecretAccessKey,\n sessionToken: assumeRoleOutput.Credentials.SessionToken,\n\n // Expiration indicates to the CLI that this is temporary\n expiration: assumeRoleOutput.Credentials.Expiration,\n};\n```\n\nTo return this:\n\n```javascript\nreturn {\n accessKeyId: assumeRoleOutput.Credentials.AccessKeyId,\n secretAccessKey: assumeRoleOutput.Credentials.SecretAccessKey,\n sessionToken: assumeRoleOutput.Credentials.SessionToken,\n};\n```\n\nNote that this will prevent the CDK CLI from refreshing the credentials when needed, and may cause your workflow to fail on an expired credentials error. \n\n## References\n\n[1] https://docs.aws.amazon.com/cdk/v2/guide/home.html\n\n[2] https://docs.aws.amazon.com/cdk/v2/guide/cli.html\n\n[3] https://docs.aws.amazon.com/cdk/v2/guide/cli.html#cli-config\n\n[4] https://www.npmjs.com/package/@aws-cdk/cli-plugin-contract\n\n[5] https://github.com/aws/aws-cdk/releases/tag/v2.178.2", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "aws-cdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.172.0" + }, + { + "fixed": "2.178.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "cdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.172.0" + }, + { + "fixed": "2.178.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2598" + }, + { + "type": "WEB", + "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-005" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aws/aws-cdk" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-497" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T17:43:09Z", + "nvd_published_at": "2025-03-21T15:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json b/advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json deleted file mode 100644 index dfa37e1fb03..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9fcg-wrp8-qhr4", - "modified": "2025-03-20T18:30:31Z", - "published": "2025-03-20T18:30:31Z", - "aliases": [ - "CVE-2025-2565" - ], - "details": "The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2565" - }, - { - "type": "WEB", - "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-201" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-20T17:15:39Z" - } -} \ No newline at end of file