diff --git a/advisories/unreviewed/2024/11/GHSA-ghx4-cgxw-7h9p/GHSA-ghx4-cgxw-7h9p.json b/advisories/github-reviewed/2024/11/GHSA-ghx4-cgxw-7h9p/GHSA-ghx4-cgxw-7h9p.json similarity index 52% rename from advisories/unreviewed/2024/11/GHSA-ghx4-cgxw-7h9p/GHSA-ghx4-cgxw-7h9p.json rename to advisories/github-reviewed/2024/11/GHSA-ghx4-cgxw-7h9p/GHSA-ghx4-cgxw-7h9p.json index 3a839d5dca1..3b224a13e12 100644 --- a/advisories/unreviewed/2024/11/GHSA-ghx4-cgxw-7h9p/GHSA-ghx4-cgxw-7h9p.json +++ b/advisories/github-reviewed/2024/11/GHSA-ghx4-cgxw-7h9p/GHSA-ghx4-cgxw-7h9p.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-ghx4-cgxw-7h9p", - "modified": "2024-11-05T00:31:28Z", + "modified": "2024-11-05T15:52:20Z", "published": "2024-11-05T00:31:28Z", "aliases": [ "CVE-2024-48057" ], + "summary": "LocalAI Cross-site Scripting vulnerability", "details": "localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.", "severity": [ - + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" + } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/mudler/LocalAI" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.20.1" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +44,14 @@ "type": "WEB", "url": "https://gist.github.com/AfterSnows/1bd7ee5a3a42dbb5f5ff67f7f9c8ccec" }, + { + "type": "PACKAGE", + "url": "https://github.com/mudler/LocalAI" + }, + { + "type": "WEB", + "url": "https://github.com/mudler/LocalAI/blob/master/core/http/views/index.html#L75" + }, { "type": "WEB", "url": "https://rumbling-slice-eb0.notion.site/LocalAI-deleted-model-with-storage-XSS-CSRF-vulnerability-in-mudler-localai-101e3cda9e8c80e0ac12fe418d5dd982?pvs=4" @@ -29,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-11-05T15:52:19Z", "nvd_published_at": "2024-11-04T23:15:04Z" } } \ No newline at end of file