diff --git a/advisories/github-reviewed/2025/04/GHSA-x2rg-q646-7m2v/GHSA-x2rg-q646-7m2v.json b/advisories/github-reviewed/2025/04/GHSA-x2rg-q646-7m2v/GHSA-x2rg-q646-7m2v.json index d6f595bb100..5cbecb62da5 100644 --- a/advisories/github-reviewed/2025/04/GHSA-x2rg-q646-7m2v/GHSA-x2rg-q646-7m2v.json +++ b/advisories/github-reviewed/2025/04/GHSA-x2rg-q646-7m2v/GHSA-x2rg-q646-7m2v.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x2rg-q646-7m2v", - "modified": "2025-04-09T13:00:07Z", + "modified": "2025-04-09T20:29:43Z", "published": "2025-04-09T13:00:07Z", "aliases": [ "CVE-2025-32379" ], "summary": "Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function", - "details": "### Summary\nIn koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.\n\n### Patches\nThis issue is patched in 2.16.1 and 3.0.0-alpha.5.\n\n### PoC\nhttps://gist.github.com/linhnph05/03d677b183636af206ff781bdd19701a\n\n### Impact\n1. Redirect user to another phishing site\n2. Make request to another endpoint of the application based on user's cookie\n3. Steal user's cookie", + "details": "### Summary\nIn koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.\n\n### Patches\nThis issue is patched in 2.16.1 and 3.0.0-alpha.5.\n\n### PoC\nComing soon...\n\n### Impact\n1. Redirect user to another phishing site\n2. Make request to another endpoint of the application based on user's cookie\n3. Steal user's cookie", "severity": [ { "type": "CVSS_V3", @@ -59,6 +59,10 @@ "type": "WEB", "url": "https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32379" + }, { "type": "WEB", "url": "https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe86355161067687312" @@ -75,6 +79,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-04-09T13:00:07Z", - "nvd_published_at": null + "nvd_published_at": "2025-04-09T16:15:25Z" } } \ No newline at end of file