diff --git a/advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json b/advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json new file mode 100644 index 00000000000..925fe88dd66 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vhr-f5xr-8vpx", + "modified": "2025-03-13T18:00:34Z", + "published": "2022-05-13T01:30:07Z", + "aliases": [ + "CVE-2015-7537" + ], + "summary": "Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack", + "details": "Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.640" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7537" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/40a28999e221a209212c30586be9c39049510bd1" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T18:00:34Z", + "nvd_published_at": "2016-02-03T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json b/advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json rename to advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json index c85a0c3ae9c..b3700625efc 100644 --- a/advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json +++ b/advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8xr3-54w2-8xjp", - "modified": "2022-05-13T01:30:59Z", + "modified": "2025-03-13T18:00:05Z", "published": "2022-05-13T01:30:59Z", "aliases": [ "CVE-2016-4987" ], + "summary": "Jenkins Image Gallery Plugin allows Path Traversal", "details": "Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.", "severity": [ { @@ -13,12 +14,40 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.tupilabs.image_gallery:image-gallery" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4987" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/image-gallery-plugin/commit/20f02f6d53e642431d5e1181a8e7be7971538d50" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/image-gallery-plugin" + }, { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20" @@ -29,8 +58,8 @@ "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T18:00:05Z", "nvd_published_at": "2017-02-09T15:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json b/advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json rename to advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json index 07885f82438..9ac87d66122 100644 --- a/advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json +++ b/advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rx4r-gxpc-h85x", - "modified": "2022-05-14T03:57:44Z", + "modified": "2025-03-13T18:00:43Z", "published": "2022-05-14T03:57:44Z", "aliases": [ "CVE-2016-3726" ], + "summary": "Jenkins affected by Open Redirect Vulnerability", "details": "Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to \"scheme-relative\" URLs.", "severity": [ { @@ -13,16 +14,63 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.652" + }, + { + "fixed": "2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.651.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3726" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1206" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11" @@ -37,10 +85,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-601" + ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T18:00:43Z", "nvd_published_at": "2016-05-17T14:08:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json b/advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json deleted file mode 100644 index 37dd0e30fe6..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3vhr-f5xr-8vpx", - "modified": "2022-05-13T01:30:07Z", - "published": "2022-05-13T01:30:07Z", - "aliases": [ - "CVE-2015-7537" - ], - "details": "Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7537" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-02-03T18:59:00Z" - } -} \ No newline at end of file