diff --git a/advisories/unreviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json b/advisories/github-reviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json similarity index 62% rename from advisories/unreviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json rename to advisories/github-reviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json index 501ffe1565e..a7db7736e2e 100644 --- a/advisories/unreviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json +++ b/advisories/github-reviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-whgj-6m78-2gg9", - "modified": "2023-06-23T18:30:21Z", + "modified": "2024-01-30T23:02:44Z", "published": "2023-06-14T15:30:37Z", "aliases": [ "CVE-2023-35147" ], + "summary": "Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin", "details": "Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:aws-codecommit-trigger" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.0.12" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-732" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:02:36Z", "nvd_published_at": "2023-06-14T13:15:12Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json b/advisories/github-reviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json new file mode 100644 index 00000000000..3d1cef295f1 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-27pr-r7hm-c2rc", + "modified": "2024-01-30T23:03:10Z", + "published": "2023-07-19T18:30:55Z", + "aliases": [ + "CVE-2023-32261" + ], + "summary": "Missing permission check in Jenkins Dimensions Plugin allows enumerating credentials IDs", + "details": "Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credentials IDs in Dimensions Plugin 0.9.3.1 requires the appropriate permissions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:dimensionsscm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.3.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.9.3" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32261" + }, + { + "type": "WEB", + "url": "https://plugins.jenkins.io/dimensionsscm/" + }, + { + "type": "WEB", + "url": "https://portal.microfocus.com/s/article/KM000019297" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3138" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:03:10Z", + "nvd_published_at": "2023-07-19T16:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json b/advisories/github-reviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json new file mode 100644 index 00000000000..206b3aa2eff --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px39-5h8c-j3c8", + "modified": "2024-01-30T23:03:23Z", + "published": "2023-07-19T18:30:56Z", + "aliases": [ + "CVE-2023-32262" + ], + "summary": "Exposure of system-scoped credentials in Jenkins Dimensions Plugin", + "details": "Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.\n\nThis allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.\n\nDimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:dimensionsscm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.3.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.9.3" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32262" + }, + { + "type": "WEB", + "url": "https://plugins.jenkins.io/dimensionsscm/" + }, + { + "type": "WEB", + "url": "https://portal.microfocus.com/s/article/KM000019298" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3143" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:03:23Z", + "nvd_published_at": "2023-07-19T16:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json b/advisories/github-reviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json similarity index 54% rename from advisories/unreviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json rename to advisories/github-reviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json index 3a81dffa633..ad6fdda190a 100644 --- a/advisories/unreviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json +++ b/advisories/github-reviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-g4qf-5523-7wvf", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:02:07Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41944" ], + "summary": "HTML injection vulnerability in Jenkins AWS CodeCommit Trigger Plugin", "details": "Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:aws-codecommit-trigger" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.0.12" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:02:07Z", "nvd_published_at": "2023-09-06T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json b/advisories/github-reviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json similarity index 54% rename from advisories/unreviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json rename to advisories/github-reviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json index d1dfa7bab56..a3bb4c68aae 100644 --- a/advisories/unreviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json +++ b/advisories/github-reviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-p986-hpr3-493p", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:01:54Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41947" ], + "summary": "Missing permission checks in Jenkins Frugal Testing Plugin", "details": "A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "io.jenkins.plugins:frugal-testing" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:01:54Z", "nvd_published_at": "2023-09-06T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json b/advisories/unreviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json deleted file mode 100644 index 4814d39a074..00000000000 --- a/advisories/unreviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-27pr-r7hm-c2rc", - "modified": "2023-07-19T18:30:55Z", - "published": "2023-07-19T18:30:55Z", - "aliases": [ - "CVE-2023-32261" - ], - "details": "\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32261" - }, - { - "type": "WEB", - "url": "https://plugins.jenkins.io/dimensionsscm/" - }, - { - "type": "WEB", - "url": "https://portal.microfocus.com/s/article/KM000019297" - }, - { - "type": "WEB", - "url": "https://www.jenkins.io/security/advisory/2023-06-14/" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-07-19T16:15:09Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json b/advisories/unreviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json deleted file mode 100644 index f7ba45f8e60..00000000000 --- a/advisories/unreviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-px39-5h8c-j3c8", - "modified": "2023-07-19T18:30:56Z", - "published": "2023-07-19T18:30:56Z", - "aliases": [ - "CVE-2023-32262" - ], - "details": "\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.\nSee the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32262" - }, - { - "type": "WEB", - "url": "https://plugins.jenkins.io/dimensionsscm/" - }, - { - "type": "WEB", - "url": "https://portal.microfocus.com/s/article/KM000019298" - }, - { - "type": "WEB", - "url": "https://www.jenkins.io/security/advisory/2023-06-14/" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-07-19T16:15:09Z" - } -} \ No newline at end of file