diff --git a/advisories/github-reviewed/2025/02/GHSA-5fwx-p6xh-vjrh/GHSA-5fwx-p6xh-vjrh.json b/advisories/github-reviewed/2025/02/GHSA-5fwx-p6xh-vjrh/GHSA-5fwx-p6xh-vjrh.json new file mode 100644 index 00000000000..0df05450535 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-5fwx-p6xh-vjrh/GHSA-5fwx-p6xh-vjrh.json @@ -0,0 +1,145 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fwx-p6xh-vjrh", + "modified": "2025-02-24T18:28:16Z", + "published": "2025-02-24T09:35:48Z", + "aliases": [ + "CVE-2025-25279" + ], + "summary": "Mattermost allows reading arbitrary files related to importing boards", + "details": "Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20250122165010-4ed702ccff4e" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0-rc1" + }, + { + "fixed": "9.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.2.0-rc1" + }, + { + "fixed": "10.2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.3.0-rc1" + }, + { + "fixed": "10.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0-rc1" + }, + { + "fixed": "10.4.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25279" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-boards/commit/025ce8d363a054473bc002f43f602a4032d38c06" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/4ed702ccff4ec3c9eff832a9b6060f9f4454141d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-24T18:28:16Z", + "nvd_published_at": "2025-02-24T08:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-5pmw-9j92-3c4c/GHSA-5pmw-9j92-3c4c.json b/advisories/github-reviewed/2025/02/GHSA-5pmw-9j92-3c4c/GHSA-5pmw-9j92-3c4c.json new file mode 100644 index 00000000000..cf848ad94b7 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-5pmw-9j92-3c4c/GHSA-5pmw-9j92-3c4c.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5pmw-9j92-3c4c", + "modified": "2025-02-24T18:27:25Z", + "published": "2025-02-24T18:27:25Z", + "aliases": [], + "summary": "OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability", + "details": "OpenH264 recently reported a [heap overflow](https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x) that was fixed in upstream [63db555](https://github.com/cisco/openh264/commit/63db555e30986e3a5f07871368dc90ae78c27449) and [integrated into](https://github.com/ralfbiedert/openh264-rs/commit/3a822fff0b4c9a984622ca2b179fe8898ac54b14) our 0.6.6 release. For users relying on Cisco's pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0. \n\nIn other words:\n- if you rely on our `source` feature only, >=0.6.6 should be safe,\n- if you rely on `libloading`, you must upgrade to 0.8.0 _and_ use their latest DLL >=2.6.0. \n\nUsers handling untrusted video files should update immediately.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "openh264-sys2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27091" + }, + { + "type": "WEB", + "url": "https://github.com/cisco/openh264/pull/3818" + }, + { + "type": "WEB", + "url": "https://github.com/ralfbiedert/openh264-rs/commit/3a822fff0b4c9a984622ca2b179fe8898ac54b14" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ralfbiedert/openh264-rs" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0008.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122", + "CWE-1395" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-24T18:27:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-hjpm-7mrm-26w8/GHSA-hjpm-7mrm-26w8.json b/advisories/github-reviewed/2025/02/GHSA-hjpm-7mrm-26w8/GHSA-hjpm-7mrm-26w8.json new file mode 100644 index 00000000000..c81a63d4072 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-hjpm-7mrm-26w8/GHSA-hjpm-7mrm-26w8.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjpm-7mrm-26w8", + "modified": "2025-02-24T18:27:55Z", + "published": "2025-02-24T18:27:55Z", + "aliases": [], + "summary": "Beter Auth has an Open Redirect via Scheme-Less Callback Parameter", + "details": "### Summary\nThe application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs (e.g., https://evil.com), it incorrectly allows scheme-less URLs (e.g., //malicious-site.com). This results in the browser interpreting the URL as https://malicious-site.com, leading to unintended redirection.\n\nbypass for : https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723\n\n### Affected Versions\nAll versions prior to 1.1.19\n\n### Details\nThe application’s email verification endpoint (/auth/verify-email) accepts a callbackURL parameter intended to redirect users after successful email verification. While the server correctly blocks fully qualified external URLs (e.g., https://evil.com), it improperly allows scheme-less URLs (e.g., //malicious-site.com). This issue occurs because browsers interpret //malicious-site.com as https://malicious-site.com, leading to an open redirect vulnerability.\n\nAn attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens.\n\n### Impact\nPhishing & Credential Theft – Attackers can redirect users to a fake login page, tricking them into entering sensitive credentials, which can then be stolen.\n\nSession Hijacking & Token Theft – If used in OAuth flows, an attacker could redirect authentication tokens to their own domain, leading to account takeover.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "better-auth" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.20" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723" + }, + { + "type": "WEB", + "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8" + }, + { + "type": "WEB", + "url": "https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153" + }, + { + "type": "PACKAGE", + "url": "https://github.com/better-auth/better-auth" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-601" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-24T18:27:55Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-q8p2-2hwc-jw64/GHSA-q8p2-2hwc-jw64.json b/advisories/github-reviewed/2025/02/GHSA-q8p2-2hwc-jw64/GHSA-q8p2-2hwc-jw64.json new file mode 100644 index 00000000000..d4c624b5110 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-q8p2-2hwc-jw64/GHSA-q8p2-2hwc-jw64.json @@ -0,0 +1,149 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q8p2-2hwc-jw64", + "modified": "2025-02-24T18:28:19Z", + "published": "2025-02-24T09:35:48Z", + "aliases": [ + "CVE-2025-24526" + ], + "summary": "Mattermost fails to restrict channel export of archived channels", + "details": "Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the \"Allow users to view archived channels\" is disabled which allows a user to export channel contents when they shouldn't have access to it", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20250110161910-96195f1bd746" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0-rc1" + }, + { + "fixed": "9.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.2.0-rc1" + }, + { + "fixed": "10.2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.3.0-rc1" + }, + { + "fixed": "10.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0-rc1" + }, + { + "fixed": "10.4.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24526" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-channel-export/issues/51" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-channel-export/commit/3c052b66207fb734bfc4c948941e7f7522a82550" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/96195f1bd7467f572525c35b5087acaeb53daa63" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-24T18:28:19Z", + "nvd_published_at": "2025-02-24T08:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-rhvr-6w8c-6v7w/GHSA-rhvr-6w8c-6v7w.json b/advisories/github-reviewed/2025/02/GHSA-rhvr-6w8c-6v7w/GHSA-rhvr-6w8c-6v7w.json new file mode 100644 index 00000000000..a0d341e10d3 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-rhvr-6w8c-6v7w/GHSA-rhvr-6w8c-6v7w.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rhvr-6w8c-6v7w", + "modified": "2025-02-24T18:28:24Z", + "published": "2025-02-24T09:35:45Z", + "aliases": [ + "CVE-2025-1412" + ], + "summary": "Mattermost fails to invalidate all active sessions when converting a user to a bot", + "details": "Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20241217145510-faa7e4f2ea0c" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0-rc1" + }, + { + "fixed": "10.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0-rc1" + }, + { + "fixed": "9.11.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1412" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/faa7e4f2ea0cca2fd2aba271912b9fc3be788842" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-384" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-02-24T18:28:24Z", + "nvd_published_at": "2025-02-24T08:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-v469-7wp6-7cvp/GHSA-v469-7wp6-7cvp.json b/advisories/github-reviewed/2025/02/GHSA-v469-7wp6-7cvp/GHSA-v469-7wp6-7cvp.json new file mode 100644 index 00000000000..6161d2e171b --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-v469-7wp6-7cvp/GHSA-v469-7wp6-7cvp.json @@ -0,0 +1,145 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v469-7wp6-7cvp", + "modified": "2025-02-24T18:28:22Z", + "published": "2025-02-24T09:35:45Z", + "aliases": [ + "CVE-2025-20051" + ], + "summary": "Mattermost allows reading arbitrary files", + "details": "Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20250122165010-4ed702ccff4e" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0-rc1" + }, + { + "fixed": "9.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.2.0-rc1" + }, + { + "fixed": "10.2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.3.0-rc1" + }, + { + "fixed": "10.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0-rc1" + }, + { + "fixed": "10.4.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20051" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-boards/commit/025ce8d363a054473bc002f43f602a4032d38c06" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/4ed702ccff4ec3c9eff832a9b6060f9f4454141d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-24T18:28:21Z", + "nvd_published_at": "2025-02-24T08:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-5fwx-p6xh-vjrh/GHSA-5fwx-p6xh-vjrh.json b/advisories/unreviewed/2025/02/GHSA-5fwx-p6xh-vjrh/GHSA-5fwx-p6xh-vjrh.json deleted file mode 100644 index 35ee2570ae0..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-5fwx-p6xh-vjrh/GHSA-5fwx-p6xh-vjrh.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5fwx-p6xh-vjrh", - "modified": "2025-02-24T09:35:48Z", - "published": "2025-02-24T09:35:48Z", - "aliases": [ - "CVE-2025-25279" - ], - "details": "Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25279" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-24T08:15:10Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-q8p2-2hwc-jw64/GHSA-q8p2-2hwc-jw64.json b/advisories/unreviewed/2025/02/GHSA-q8p2-2hwc-jw64/GHSA-q8p2-2hwc-jw64.json deleted file mode 100644 index 5d4f0e9bb35..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-q8p2-2hwc-jw64/GHSA-q8p2-2hwc-jw64.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q8p2-2hwc-jw64", - "modified": "2025-02-24T09:35:48Z", - "published": "2025-02-24T09:35:48Z", - "aliases": [ - "CVE-2025-24526" - ], - "details": "Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the \"Allow users to view archived channels\" is disabled which allows a user to export channel contents when they shouldn't have access to it", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24526" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-24T08:15:10Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-rhvr-6w8c-6v7w/GHSA-rhvr-6w8c-6v7w.json b/advisories/unreviewed/2025/02/GHSA-rhvr-6w8c-6v7w/GHSA-rhvr-6w8c-6v7w.json deleted file mode 100644 index a8aa465dd73..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-rhvr-6w8c-6v7w/GHSA-rhvr-6w8c-6v7w.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rhvr-6w8c-6v7w", - "modified": "2025-02-24T09:35:45Z", - "published": "2025-02-24T09:35:45Z", - "aliases": [ - "CVE-2025-1412" - ], - "details": "Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1412" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-384" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-24T08:15:09Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v469-7wp6-7cvp/GHSA-v469-7wp6-7cvp.json b/advisories/unreviewed/2025/02/GHSA-v469-7wp6-7cvp/GHSA-v469-7wp6-7cvp.json deleted file mode 100644 index cc574e7a801..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-v469-7wp6-7cvp/GHSA-v469-7wp6-7cvp.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v469-7wp6-7cvp", - "modified": "2025-02-24T09:35:45Z", - "published": "2025-02-24T09:35:45Z", - "aliases": [ - "CVE-2025-20051" - ], - "details": "Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20051" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-24T08:15:10Z" - } -} \ No newline at end of file