From 8bb55bbfae0f6a04666de1a52a5bd8cddc2091f1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 22 Apr 2025 18:44:16 +0000 Subject: [PATCH] Publish Advisories GHSA-23gj-x27g-r34f GHSA-7hhg-xj2h-5vq9 GHSA-cgrv-6h2h-6f7v GHSA-vrw6-7vgj-vj7x --- .../GHSA-23gj-x27g-r34f.json | 33 ++++++++++++++++--- .../GHSA-7hhg-xj2h-5vq9.json | 33 ++++++++++++++++--- .../GHSA-cgrv-6h2h-6f7v.json | 33 ++++++++++++++++--- .../GHSA-vrw6-7vgj-vj7x.json | 33 ++++++++++++++++--- 4 files changed, 116 insertions(+), 16 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json (60%) diff --git a/advisories/unreviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json b/advisories/github-reviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json rename to advisories/github-reviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json index c6c387cded2..c7b9cd0373a 100644 --- a/advisories/unreviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json +++ b/advisories/github-reviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-23gj-x27g-r34f", - "modified": "2025-04-20T03:37:51Z", + "modified": "2025-04-22T18:43:38Z", "published": "2022-05-17T02:43:14Z", "aliases": [ "CVE-2017-9069" ], + "summary": "MODX Revolution allows overwriting .htaccess", "details": "In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "modx/revolution" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.7" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -26,6 +47,10 @@ { "type": "WEB", "url": "https://citadelo.com/en/2017/04/modx-revolution-cms" + }, + { + "type": "PACKAGE", + "url": "https://github.com/modxcms/revolution" } ], "database_specific": { @@ -33,8 +58,8 @@ "CWE-434" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T18:43:38Z", "nvd_published_at": "2017-05-18T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json b/advisories/github-reviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json rename to advisories/github-reviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json index 70e4d0da0ea..952c0f0850a 100644 --- a/advisories/unreviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json +++ b/advisories/github-reviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7hhg-xj2h-5vq9", - "modified": "2025-04-20T03:37:51Z", + "modified": "2025-04-22T18:43:50Z", "published": "2022-05-17T02:43:14Z", "aliases": [ "CVE-2017-9070" ], + "summary": "MODX Revolution cross-site scripting vulnerability", "details": "In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "modx/revolution" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.7" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -26,6 +47,10 @@ { "type": "WEB", "url": "https://citadelo.com/en/2017/04/modx-revolution-cms" + }, + { + "type": "PACKAGE", + "url": "https://github.com/modxcms/revolution" } ], "database_specific": { @@ -33,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T18:43:50Z", "nvd_published_at": "2017-05-18T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json b/advisories/github-reviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json rename to advisories/github-reviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json index 06a2436b445..590553cd50a 100644 --- a/advisories/unreviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json +++ b/advisories/github-reviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cgrv-6h2h-6f7v", - "modified": "2025-04-20T03:37:51Z", + "modified": "2025-04-22T18:42:58Z", "published": "2022-05-17T02:43:12Z", "aliases": [ "CVE-2017-9067" ], + "summary": "MODX Revolution Directory Traversal Vulnerability", "details": "In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "modx/revolution" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.7" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -30,6 +51,10 @@ { "type": "WEB", "url": "https://citadelo.com/en/2017/04/modx-revolution-cms" + }, + { + "type": "PACKAGE", + "url": "https://github.com/modxcms/revolution" } ], "database_specific": { @@ -37,8 +62,8 @@ "CWE-22" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T18:42:58Z", "nvd_published_at": "2017-05-18T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json b/advisories/github-reviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json rename to advisories/github-reviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json index 02d9fc0ebed..8425f3069b2 100644 --- a/advisories/unreviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json +++ b/advisories/github-reviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vrw6-7vgj-vj7x", - "modified": "2025-04-20T03:37:51Z", + "modified": "2025-04-22T18:43:09Z", "published": "2022-05-17T02:43:14Z", "aliases": [ "CVE-2017-9068" ], + "summary": "MODX Revolution Reflected XSS", "details": "In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "modx/revolution" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.7" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -26,6 +47,10 @@ { "type": "WEB", "url": "https://citadelo.com/en/2017/04/modx-revolution-cms" + }, + { + "type": "PACKAGE", + "url": "https://github.com/modxcms/revolution" } ], "database_specific": { @@ -33,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T18:43:09Z", "nvd_published_at": "2017-05-18T16:29:00Z" } } \ No newline at end of file