From 8365d5fb6c651fc255f82021ab708abce888e750 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 13 Sep 2024 18:04:17 +0000
Subject: [PATCH] Publish GHSA-76x8-gg39-5jjg

---
 .../GHSA-76x8-gg39-5jjg.json                  | 105 +++++++++++-------
 1 file changed, 66 insertions(+), 39 deletions(-)

diff --git a/advisories/github-reviewed/2022/05/GHSA-76x8-gg39-5jjg/GHSA-76x8-gg39-5jjg.json b/advisories/github-reviewed/2022/05/GHSA-76x8-gg39-5jjg/GHSA-76x8-gg39-5jjg.json
index 4caf803e1ec..cd221a48dc0 100644
--- a/advisories/github-reviewed/2022/05/GHSA-76x8-gg39-5jjg/GHSA-76x8-gg39-5jjg.json
+++ b/advisories/github-reviewed/2022/05/GHSA-76x8-gg39-5jjg/GHSA-76x8-gg39-5jjg.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-76x8-gg39-5jjg",
-  "modified": "2024-04-01T19:52:43Z",
+  "modified": "2024-09-13T18:02:56Z",
   "published": "2022-05-01T23:28:42Z",
   "aliases": [
     "CVE-2008-0252"
@@ -9,7 +9,14 @@
   "summary": "CherryPy Malicious cookies allow access to files outside the session directory",
   "details": "Directory traversal vulnerability in the _get_file_path function in (1) `lib/sessions.py` in CherryPy 3.0.x up to 3.0.2, (2) `filter/sessionfilter.py` in CherryPy 2.1, and (3) `filter/sessionfilter.py` in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -25,14 +32,30 @@
               "introduced": "0"
             },
             {
-              "fixed": "3.0.3"
+              "fixed": "2.1.1"
             }
           ]
         }
-      ],
-      "database_specific": {
-        "last_known_affected_version_range": "<= 3.0.2"
-      }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "cherrypy"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0"
+            },
+            {
+              "fixed": "3.0.2"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
@@ -48,10 +71,46 @@
       "type": "WEB",
       "url": "https://bugs.gentoo.org/show_bug.cgi?id=204829"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/cherrypy/cherrypy"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/cherrypy/PYSEC-2008-3.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://issues.rpath.com/browse/RPL-2127"
     },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20080129011723/http://secunia.com/advisories/28354"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20080312130713/http://secunia.com/advisories/28353"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20080328003510/http://secunia.com/advisories/28611"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20100122080212/http://www.vupen.com/english/advisories/2008/0039"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20110513223620/http://secunia.com/advisories/28769"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20111224161644/http://secunia.com/advisories/28620"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20151108024505/http://www.securityfocus.com/bid/27181"
+    },
     {
       "type": "WEB",
       "url": "https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00240.html"
@@ -60,26 +119,6 @@
       "type": "WEB",
       "url": "https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00297.html"
     },
-    {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/28353"
-    },
-    {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/28354"
-    },
-    {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/28611"
-    },
-    {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/28620"
-    },
-    {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/28769"
-    },
     {
       "type": "WEB",
       "url": "http://security.gentoo.org/glsa/glsa-200801-11.xml"
@@ -103,18 +142,6 @@
     {
       "type": "WEB",
       "url": "http://www.debian.org/security/2008/dsa-1481"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/archive/1/487001/100/0/threaded"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/27181"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.vupen.com/english/advisories/2008/0039"
     }
   ],
   "database_specific": {