diff --git a/advisories/github-reviewed/2023/07/GHSA-8hc6-w44m-wfxf/GHSA-8hc6-w44m-wfxf.json b/advisories/github-reviewed/2023/07/GHSA-8hc6-w44m-wfxf/GHSA-8hc6-w44m-wfxf.json new file mode 100644 index 00000000000..72f0eee4a9b --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-8hc6-w44m-wfxf/GHSA-8hc6-w44m-wfxf.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8hc6-w44m-wfxf", + "modified": "2024-01-30T23:04:11Z", + "published": "2023-07-19T18:30:56Z", + "aliases": [ + "CVE-2023-32263" + ], + "summary": "Potential leak of credentials in Micro Focus Dimensions CM Jenkins Plugin", + "details": "A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login certificate if an authenticated user is duped into using an attacker-controlled Dimensions CM server. This vulnerability only applies when the Jenkins plugin is configured to use login certificate credentials.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:dimensionsscm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.8.17" + }, + { + "fixed": "0.9.3.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.9.3" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32263" + }, + { + "type": "WEB", + "url": "https://plugins.jenkins.io/dimensionsscm/" + }, + { + "type": "WEB", + "url": "https://portal.microfocus.com/s/article/KM000019293" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2023-06-14/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:04:11Z", + "nvd_published_at": "2023-07-19T16:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-pvjf-4hfg-wr84/GHSA-pvjf-4hfg-wr84.json b/advisories/github-reviewed/2023/07/GHSA-pvjf-4hfg-wr84/GHSA-pvjf-4hfg-wr84.json similarity index 57% rename from advisories/unreviewed/2023/07/GHSA-pvjf-4hfg-wr84/GHSA-pvjf-4hfg-wr84.json rename to advisories/github-reviewed/2023/07/GHSA-pvjf-4hfg-wr84/GHSA-pvjf-4hfg-wr84.json index 74c78a687d9..ef9ff0b686f 100644 --- a/advisories/unreviewed/2023/07/GHSA-pvjf-4hfg-wr84/GHSA-pvjf-4hfg-wr84.json +++ b/advisories/github-reviewed/2023/07/GHSA-pvjf-4hfg-wr84/GHSA-pvjf-4hfg-wr84.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pvjf-4hfg-wr84", - "modified": "2023-07-31T18:30:21Z", + "modified": "2024-01-30T23:04:31Z", "published": "2023-07-26T15:30:57Z", "aliases": [ "CVE-2023-39152" ], + "summary": "Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log", "details": "Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:gradle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.8" + } + } ], "references": [ { @@ -34,9 +56,9 @@ "cwe_ids": [ "CWE-670" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:04:31Z", "nvd_published_at": "2023-07-26T14:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-5jxp-f5rr-g6jc/GHSA-5jxp-f5rr-g6jc.json b/advisories/github-reviewed/2023/09/GHSA-5jxp-f5rr-g6jc/GHSA-5jxp-f5rr-g6jc.json similarity index 53% rename from advisories/unreviewed/2023/09/GHSA-5jxp-f5rr-g6jc/GHSA-5jxp-f5rr-g6jc.json rename to advisories/github-reviewed/2023/09/GHSA-5jxp-f5rr-g6jc/GHSA-5jxp-f5rr-g6jc.json index a472fc8c7c3..c3cff2725c5 100644 --- a/advisories/unreviewed/2023/09/GHSA-5jxp-f5rr-g6jc/GHSA-5jxp-f5rr-g6jc.json +++ b/advisories/github-reviewed/2023/09/GHSA-5jxp-f5rr-g6jc/GHSA-5jxp-f5rr-g6jc.json @@ -1,17 +1,42 @@ { "schema_version": "1.4.0", "id": "GHSA-5jxp-f5rr-g6jc", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:04:47Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41931" ], + "summary": "XSS vulnerability in Jenkins Job Configuration History Plugin", "details": "Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:jobConfigHistory" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1229.v3039470161a_d" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1227.v7a" + } + } ], "references": [ { @@ -29,11 +54,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:04:47Z", "nvd_published_at": "2023-09-06T13:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-63vw-rprv-4f8j/GHSA-63vw-rprv-4f8j.json b/advisories/github-reviewed/2023/09/GHSA-63vw-rprv-4f8j/GHSA-63vw-rprv-4f8j.json similarity index 53% rename from advisories/unreviewed/2023/09/GHSA-63vw-rprv-4f8j/GHSA-63vw-rprv-4f8j.json rename to advisories/github-reviewed/2023/09/GHSA-63vw-rprv-4f8j/GHSA-63vw-rprv-4f8j.json index be89dfa4c10..175f8b223dc 100644 --- a/advisories/unreviewed/2023/09/GHSA-63vw-rprv-4f8j/GHSA-63vw-rprv-4f8j.json +++ b/advisories/github-reviewed/2023/09/GHSA-63vw-rprv-4f8j/GHSA-63vw-rprv-4f8j.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-63vw-rprv-4f8j", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:05:03Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41938" ], + "summary": "CSRF vulnerability in Jenkins Ivy Plugin", "details": "A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:ivy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.5" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:05:03Z", "nvd_published_at": "2023-09-06T13:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-8hc6-w44m-wfxf/GHSA-8hc6-w44m-wfxf.json b/advisories/unreviewed/2023/07/GHSA-8hc6-w44m-wfxf/GHSA-8hc6-w44m-wfxf.json deleted file mode 100644 index 2145c1fbff6..00000000000 --- a/advisories/unreviewed/2023/07/GHSA-8hc6-w44m-wfxf/GHSA-8hc6-w44m-wfxf.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8hc6-w44m-wfxf", - "modified": "2023-07-19T18:30:56Z", - "published": "2023-07-19T18:30:56Z", - "aliases": [ - "CVE-2023-32263" - ], - "details": "\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login certificate if an authenticated user is duped into using an attacker-controlled Dimensions CM server. This vulnerability only applies when the Jenkins plugin is configured to use login certificate credentials.\n\n\n https://www.jenkins.io/security/advisory/2023-06-14/ \n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32263" - }, - { - "type": "WEB", - "url": "https://plugins.jenkins.io/dimensionsscm/" - }, - { - "type": "WEB", - "url": "https://portal.microfocus.com/s/article/KM000019293" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-07-19T16:15:09Z" - } -} \ No newline at end of file