diff --git a/advisories/github-reviewed/2021/10/GHSA-68jc-v27h-vhmw/GHSA-68jc-v27h-vhmw.json b/advisories/github-reviewed/2021/10/GHSA-68jc-v27h-vhmw/GHSA-68jc-v27h-vhmw.json index 0eb332628d6..58e17e3b102 100644 --- a/advisories/github-reviewed/2021/10/GHSA-68jc-v27h-vhmw/GHSA-68jc-v27h-vhmw.json +++ b/advisories/github-reviewed/2021/10/GHSA-68jc-v27h-vhmw/GHSA-68jc-v27h-vhmw.json @@ -82,7 +82,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "7.0" + "introduced": "7.0.0" }, { "fixed": "7.74" @@ -90,6 +90,82 @@ ] } ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.74" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.9.0" + }, + { + "fixed": "8.9.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.8" + } + ] + } + ] } ], "references": [ @@ -97,10 +173,26 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13671" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/drupal/core" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/" diff --git a/advisories/github-reviewed/2022/05/GHSA-m648-hpf8-qcjw/GHSA-m648-hpf8-qcjw.json b/advisories/github-reviewed/2022/05/GHSA-m648-hpf8-qcjw/GHSA-m648-hpf8-qcjw.json index 76427fea205..7a35670ef9a 100644 --- a/advisories/github-reviewed/2022/05/GHSA-m648-hpf8-qcjw/GHSA-m648-hpf8-qcjw.json +++ b/advisories/github-reviewed/2022/05/GHSA-m648-hpf8-qcjw/GHSA-m648-hpf8-qcjw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m648-hpf8-qcjw", - "modified": "2023-12-20T21:03:22Z", + "modified": "2024-02-06T13:09:44Z", "published": "2022-05-24T19:05:06Z", "aliases": [ "CVE-2020-13663" @@ -9,47 +9,12 @@ "summary": "Drupal Core Cross-Site Request Forgery (CSRF) vulnerability", "details": "Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ - { - "package": { - "ecosystem": "Packagist", - "name": "drupal/core" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "7.0" - }, - { - "fixed": "7.72" - } - ] - } - ] - }, - { - "package": { - "ecosystem": "Packagist", - "name": "drupal/core" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "8.8.0" - }, - { - "fixed": "8.8.8" - } - ] - } - ] - }, { "package": { "ecosystem": "Packagist", @@ -87,6 +52,120 @@ ] } ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.72" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.8.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.72" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.8.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.9.0" + }, + { + "fixed": "8.9.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.1" + } + ] + } + ] } ], "references": [ @@ -106,6 +185,14 @@ "type": "WEB", "url": "https://github.com/drupal/core/commit/faf3243c4ce03bbaab386af2b272b363fd0dfddb" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13663.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13663.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/drupal/core" @@ -119,7 +206,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": "CRITICAL", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-12-20T21:03:22Z", "nvd_published_at": "2021-06-11T16:15:00Z"