From 881eabcc9bece857b953006c324569ca3e0f6942 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 13 Mar 2025 18:02:23 +0000 Subject: [PATCH] Publish Advisories GHSA-3vhr-f5xr-8vpx GHSA-8xr3-54w2-8xjp GHSA-rx4r-gxpc-h85x GHSA-3vhr-f5xr-8vpx --- .../GHSA-3vhr-f5xr-8vpx.json | 92 +++++++++++++++++++ .../GHSA-8xr3-54w2-8xjp.json | 37 +++++++- .../GHSA-rx4r-gxpc-h85x.json | 60 +++++++++++- .../GHSA-3vhr-f5xr-8vpx.json | 44 --------- 4 files changed, 180 insertions(+), 53 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json (51%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json (50%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json diff --git a/advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json b/advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json new file mode 100644 index 00000000000..925fe88dd66 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vhr-f5xr-8vpx", + "modified": "2025-03-13T18:00:34Z", + "published": "2022-05-13T01:30:07Z", + "aliases": [ + "CVE-2015-7537" + ], + "summary": "Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack", + "details": "Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.640" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7537" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/40a28999e221a209212c30586be9c39049510bd1" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T18:00:34Z", + "nvd_published_at": "2016-02-03T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json b/advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json rename to advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json index c85a0c3ae9c..b3700625efc 100644 --- a/advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json +++ b/advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8xr3-54w2-8xjp", - "modified": "2022-05-13T01:30:59Z", + "modified": "2025-03-13T18:00:05Z", "published": "2022-05-13T01:30:59Z", "aliases": [ "CVE-2016-4987" ], + "summary": "Jenkins Image Gallery Plugin allows Path Traversal", "details": "Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.", "severity": [ { @@ -13,12 +14,40 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.tupilabs.image_gallery:image-gallery" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4987" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/image-gallery-plugin/commit/20f02f6d53e642431d5e1181a8e7be7971538d50" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/image-gallery-plugin" + }, { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20" @@ -29,8 +58,8 @@ "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T18:00:05Z", "nvd_published_at": "2017-02-09T15:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json b/advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json rename to advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json index 07885f82438..9ac87d66122 100644 --- a/advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json +++ b/advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rx4r-gxpc-h85x", - "modified": "2022-05-14T03:57:44Z", + "modified": "2025-03-13T18:00:43Z", "published": "2022-05-14T03:57:44Z", "aliases": [ "CVE-2016-3726" ], + "summary": "Jenkins affected by Open Redirect Vulnerability", "details": "Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to \"scheme-relative\" URLs.", "severity": [ { @@ -13,16 +14,63 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.652" + }, + { + "fixed": "2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.651.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3726" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1206" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11" @@ -37,10 +85,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-601" + ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T18:00:43Z", "nvd_published_at": "2016-05-17T14:08:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json b/advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json deleted file mode 100644 index 37dd0e30fe6..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3vhr-f5xr-8vpx", - "modified": "2022-05-13T01:30:07Z", - "published": "2022-05-13T01:30:07Z", - "aliases": [ - "CVE-2015-7537" - ], - "details": "Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7537" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-02-03T18:59:00Z" - } -} \ No newline at end of file