netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-m5gv-m5f9-wgv4
GHSA-54f4-v6v9-9q82
GHSA-mq92-jr35-ffpc
GHSA-xcvc-5hgv-phqg
This commit is contained in:
advisory-database[bot]
2024-10-09 22:14:08 +00:00
parent ac2215e015
commit 9d4b3cc250
4 changed files with 80 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/09/GHSA-m5gv-m5f9-wgv4/GHSA-m5gv-m5f9-wgv4.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m5gv-m5f9-wgv4",
"modified": "2024-10-01T22:29:13Z",
"modified": "2024-10-09T22:12:28Z",
"published": "2024-09-25T18:31:21Z",
"aliases": [
"CVE-2024-8996"
@@ -67,6 +67,10 @@
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/cve-2024-8996"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3170"
}
],
"database_specific": {
advisories/unreviewed/2024/10/GHSA-54f4-v6v9-9q82/GHSA-54f4-v6v9-9q82.json → advisories/github-reviewed/2024/10/GHSA-54f4-v6v9-9q82/GHSA-54f4-v6v9-9q82.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-54f4-v6v9-9q82",
"modified": "2024-10-09T21:31:08Z",
"modified": "2024-10-09T22:09:16Z",
"published": "2024-10-09T21:31:08Z",
"aliases": [
"CVE-2024-7037"
],
"summary": "open-webui allows writing and deleting arbitrary files",
"details": "In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.8"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7037"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/blob/main/backend/main.py#L1513"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/8508db68-9c99-4b1c-828c-e1bfcacfb847"
@@ -31,8 +62,8 @@
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-10-09T22:09:16Z",
"nvd_published_at": "2024-10-09T20:15:09Z"
}
}
advisories/github-reviewed/2024/10/GHSA-mq92-jr35-ffpc/GHSA-mq92-jr35-ffpc.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mq92-jr35-ffpc",
"modified": "2024-10-09T22:07:49Z",
"modified": "2024-10-09T22:09:43Z",
"published": "2024-10-09T21:31:08Z",
"aliases": [
"CVE-2024-7038"
@@ -48,6 +48,10 @@
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/blob/eff736acd2e0bbbdd0eeca4cc209b216a1f23b6a/backend/apps/rag/main.py#L199"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/f42cf72a-8015-44a6-81a9-c6332ef05afc"
advisories/unreviewed/2024/10/GHSA-xcvc-5hgv-phqg/GHSA-xcvc-5hgv-phqg.json → advisories/github-reviewed/2024/10/GHSA-xcvc-5hgv-phqg/GHSA-xcvc-5hgv-phqg.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xcvc-5hgv-phqg",
"modified": "2024-10-09T21:31:08Z",
"modified": "2024-10-09T22:10:34Z",
"published": "2024-10-09T21:31:08Z",
"aliases": [
"CVE-2024-7041"
],
"summary": "open-webui Insecure Direct Object Reference (IDOR) vulnerability",
"details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.8"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7041"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/blob/main/backend/apps/webui/routers/memories.py#L71"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/6855227f-1237-47b8-8d37-29aad7ddec3a"
@@ -31,8 +62,8 @@
"CWE-250"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-10-09T22:10:34Z",
"nvd_published_at": "2024-10-09T20:15:09Z"
}
}