From 87f168f487910be9ed40a34076f8dabec9d87dcb Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 27 Oct 2023 14:23:57 +0000
Subject: [PATCH] Publish Advisories

GHSA-h6qv-f5gf-8gcf
GHSA-998m-f2x3-jjq4
---
 .../2021/06/GHSA-h6qv-f5gf-8gcf/GHSA-h6qv-f5gf-8gcf.json    | 4 ++--
 .../2022/05/GHSA-998m-f2x3-jjq4/GHSA-998m-f2x3-jjq4.json    | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/advisories/github-reviewed/2021/06/GHSA-h6qv-f5gf-8gcf/GHSA-h6qv-f5gf-8gcf.json b/advisories/github-reviewed/2021/06/GHSA-h6qv-f5gf-8gcf/GHSA-h6qv-f5gf-8gcf.json
index 89dce1d41f6..36c3176f877 100644
--- a/advisories/github-reviewed/2021/06/GHSA-h6qv-f5gf-8gcf/GHSA-h6qv-f5gf-8gcf.json
+++ b/advisories/github-reviewed/2021/06/GHSA-h6qv-f5gf-8gcf/GHSA-h6qv-f5gf-8gcf.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h6qv-f5gf-8gcf",
-  "modified": "2022-12-15T18:21:22Z",
+  "modified": "2023-10-27T14:23:01Z",
   "published": "2021-06-16T17:29:35Z",
   "aliases": [
     "CVE-2021-21654"
   ],
   "summary": "Missing Authorization in Jenkins P4 plugin",
-  "details": "Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.\n\nP4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.",
+  "details": "Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.\n\nJenkins P4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2022/05/GHSA-998m-f2x3-jjq4/GHSA-998m-f2x3-jjq4.json b/advisories/github-reviewed/2022/05/GHSA-998m-f2x3-jjq4/GHSA-998m-f2x3-jjq4.json
index b4562b68305..17f7c54121d 100644
--- a/advisories/github-reviewed/2022/05/GHSA-998m-f2x3-jjq4/GHSA-998m-f2x3-jjq4.json
+++ b/advisories/github-reviewed/2022/05/GHSA-998m-f2x3-jjq4/GHSA-998m-f2x3-jjq4.json
@@ -1,17 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-998m-f2x3-jjq4",
-  "modified": "2022-12-13T19:26:33Z",
+  "modified": "2023-10-27T14:22:04Z",
   "published": "2022-05-24T17:48:05Z",
   "aliases": [
     "CVE-2021-21644"
   ],
   "summary": "CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files",
-  "details": "Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID.\n\nThis is due to an incomplete fix of [SECURITY-938](https://www.jenkins.io/security/advisory/2018-09-25/#SECURITY-938).\n\nConfig File Provider Plugin 3.7.1 requires POST requests for the affected HTTP endpoint.",
+  "details": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID.\n\nThis is due to an incomplete fix of [SECURITY-938](https://www.jenkins.io/security/advisory/2018-09-25/#SECURITY-938).\n\nJenkins Config File Provider Plugin 3.7.1 requires POST requests for the affected HTTP endpoint.",
   "severity": [
     {
       "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
     }
   ],
   "affected": [