From 901beed90e248c2b2a07cd45ea2164aa0ae4c269 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 17:30:35 +0000 Subject: [PATCH] Publish Advisories GHSA-2mg9-hv69-897x GHSA-c7jj-vfmr-j9mj GHSA-g5m5-j48g-fr24 GHSA-gqrp-qhv8-phrv GHSA-m34m-fgh4-v7cx GHSA-2mg9-hv69-897x GHSA-c7jj-vfmr-j9mj GHSA-m34m-fgh4-v7cx --- .../GHSA-2mg9-hv69-897x.json | 108 ++++++++++++++++ .../GHSA-c7jj-vfmr-j9mj.json | 73 +++++++++++ .../GHSA-g5m5-j48g-fr24.json | 26 +++- .../GHSA-gqrp-qhv8-phrv.json | 69 +++++++++- .../GHSA-m34m-fgh4-v7cx.json | 118 ++++++++++++++++++ .../GHSA-2mg9-hv69-897x.json | 43 ------- .../GHSA-c7jj-vfmr-j9mj.json | 42 ------- .../GHSA-m34m-fgh4-v7cx.json | 38 ------ 8 files changed, 385 insertions(+), 132 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json (51%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json diff --git a/advisories/github-reviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json b/advisories/github-reviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json new file mode 100644 index 00000000000..6213e8bda76 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json @@ -0,0 +1,108 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mg9-hv69-897x", + "modified": "2024-04-24T17:29:07Z", + "published": "2022-05-24T16:52:01Z", + "aliases": [ + "CVE-2019-10187" + ], + "summary": "Moodle Ability to delete glossary entries that belong to another glossary", + "details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7" + }, + { + "fixed": "3.7.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6" + }, + { + "fixed": "3.6.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.5.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10187" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=388568#p1566330" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/109174" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284", + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:29:07Z", + "nvd_published_at": "2019-07-31T22:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json b/advisories/github-reviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json new file mode 100644 index 00000000000..172866d040e --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c7jj-vfmr-j9mj", + "modified": "2024-04-24T17:29:50Z", + "published": "2022-05-24T19:06:04Z", + "aliases": [ + "CVE-2021-21809" + ], + "summary": "Moodle command execution vulnerability exists in the default legacy spellchecker plugin", + "details": "A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "versions": [ + "3.10.0" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "versions": [ + "3.11.2" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "versions": [ + "3.8.0" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21809" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277" + }, + { + "type": "WEB", + "url": "http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:29:50Z", + "nvd_published_at": "2021-06-23T22:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json b/advisories/github-reviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json rename to advisories/github-reviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json index 547df93e7d5..ed0714b9071 100644 --- a/advisories/unreviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json +++ b/advisories/github-reviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json @@ -1,17 +1,29 @@ { "schema_version": "1.4.0", "id": "GHSA-g5m5-j48g-fr24", - "modified": "2022-05-24T19:05:25Z", + "modified": "2024-04-24T17:29:14Z", "published": "2022-05-24T19:05:25Z", "aliases": [ "CVE-2021-32244" ], + "summary": "Moodle Cross Site Scripting (XSS)", "details": "Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the \"Description\" field.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "versions": [ + "3.10.3" + ] + } ], "references": [ { @@ -21,6 +33,10 @@ { "type": "WEB", "url": "https://github.com/langkexiansheng/Images/blob/master/moodle_xss.gif" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" } ], "database_specific": { @@ -28,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:29:14Z", "nvd_published_at": "2021-06-16T21:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json b/advisories/github-reviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json rename to advisories/github-reviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json index 2379a55c519..fdbbec3fdf2 100644 --- a/advisories/unreviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json +++ b/advisories/github-reviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gqrp-qhv8-phrv", - "modified": "2022-05-13T01:34:31Z", + "modified": "2024-04-24T17:29:57Z", "published": "2022-05-13T01:34:31Z", "aliases": [ "CVE-2018-14631" ], + "summary": "Moodle Cross-site Scripting", "details": "moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.", "severity": [ { @@ -14,7 +15,63 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.5.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +82,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=376025" @@ -43,8 +104,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:29:57Z", "nvd_published_at": "2018-09-17T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json b/advisories/github-reviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json new file mode 100644 index 00000000000..59ec3edbc39 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m34m-fgh4-v7cx", + "modified": "2024-04-24T17:30:08Z", + "published": "2022-05-13T01:46:59Z", + "aliases": [ + "CVE-2017-7489" + ], + "summary": "Moodle External blog editing takeover", + "details": "In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.20" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7489" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=352353" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:30:08Z", + "nvd_published_at": "2017-05-15T14:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json b/advisories/unreviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json deleted file mode 100644 index 77976a79cf8..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2mg9-hv69-897x", - "modified": "2022-05-24T16:52:01Z", - "published": "2022-05-24T16:52:01Z", - "aliases": [ - "CVE-2019-10187" - ], - "details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10187" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=388568#p1566330" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/109174" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-07-31T22:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json b/advisories/unreviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json deleted file mode 100644 index 512837e02fb..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-c7jj-vfmr-j9mj", - "modified": "2022-05-24T19:06:04Z", - "published": "2022-05-24T19:06:04Z", - "aliases": [ - "CVE-2021-21809" - ], - "details": "A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21809" - }, - { - "type": "WEB", - "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277" - }, - { - "type": "WEB", - "url": "http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-732" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-06-23T22:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json b/advisories/unreviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json deleted file mode 100644 index a6d3524f837..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m34m-fgh4-v7cx", - "modified": "2022-05-13T01:46:59Z", - "published": "2022-05-13T01:46:59Z", - "aliases": [ - "CVE-2017-7489" - ], - "details": "In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7489" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=352353" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-269" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-05-15T14:29:00Z" - } -} \ No newline at end of file