From a0e1eeab60754228bde3c856b28ab06adbd0a0f3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 17:11:50 +0000 Subject: [PATCH] Publish Advisories GHSA-4c9q-64gq-xhx4 GHSA-6349-53vr-7hcr GHSA-7ff4-cv53-4cjq GHSA-fgj8-93xx-f6g6 GHSA-6349-53vr-7hcr GHSA-fgj8-93xx-f6g6 --- .../GHSA-4c9q-64gq-xhx4.json | 30 ++++- .../GHSA-6349-53vr-7hcr.json | 124 ++++++++++++++++++ .../GHSA-7ff4-cv53-4cjq.json | 54 +++++++- .../GHSA-fgj8-93xx-f6g6.json | 96 ++++++++++++++ .../GHSA-6349-53vr-7hcr.json | 63 --------- .../GHSA-fgj8-93xx-f6g6.json | 47 ------- 6 files changed, 296 insertions(+), 118 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json (76%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json (64%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json diff --git a/advisories/unreviewed/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json b/advisories/github-reviewed/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json similarity index 76% rename from advisories/unreviewed/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json rename to advisories/github-reviewed/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json index b29ac78f935..f4df13bac77 100644 --- a/advisories/unreviewed/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json +++ b/advisories/github-reviewed/2022/05/GHSA-4c9q-64gq-xhx4/GHSA-4c9q-64gq-xhx4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4c9q-64gq-xhx4", - "modified": "2023-02-02T21:34:15Z", + "modified": "2024-04-24T17:10:17Z", "published": "2022-05-24T22:00:34Z", "aliases": [ "CVE-2019-12922" ], + "summary": "phpMyAdmin Cross-Site Request Forgery (CSRF)", "details": "A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.9.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.9.0.1" + } + } ], "references": [ { @@ -67,8 +89,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:10:17Z", "nvd_published_at": "2019-09-13T13:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json b/advisories/github-reviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json new file mode 100644 index 00000000000..8b0b083ae41 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json @@ -0,0 +1,124 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6349-53vr-7hcr", + "modified": "2024-04-24T17:11:18Z", + "published": "2022-05-24T17:30:27Z", + "aliases": [ + "CVE-2020-26934" + ], + "summary": "phpMyAdmin Cross-site Scripting (XSS)", + "details": "phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.9.0" + }, + { + "fixed": "4.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26934" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-26934.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/phpmyadmin/composer" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5" + }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202101-35" + }, + { + "type": "WEB", + "url": "https://www.phpmyadmin.net/security/PMASA-2020-5" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:11:18Z", + "nvd_published_at": "2020-10-10T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json b/advisories/github-reviewed/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json rename to advisories/github-reviewed/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json index bd3f2c8aebc..34673640c8d 100644 --- a/advisories/unreviewed/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json +++ b/advisories/github-reviewed/2022/05/GHSA-7ff4-cv53-4cjq/GHSA-7ff4-cv53-4cjq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7ff4-cv53-4cjq", - "modified": "2023-02-01T00:30:29Z", + "modified": "2024-04-24T17:11:22Z", "published": "2022-05-24T17:30:27Z", "aliases": [ "CVE-2020-26935" ], + "summary": "phpMyAdmin SQL injection vulnerability", "details": "An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.", "severity": [ { @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.9.0" + }, + { + "fixed": "4.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.0.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +63,14 @@ "type": "WEB", "url": "https://advisory.checkmarx.net/advisory/CX-2020-4281" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-26935.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/phpmyadmin/composer" + }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html" @@ -63,8 +109,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:11:22Z", "nvd_published_at": "2020-10-10T19:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json b/advisories/github-reviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json new file mode 100644 index 00000000000..0adf1469f0e --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fgj8-93xx-f6g6", + "modified": "2024-04-24T17:11:13Z", + "published": "2022-05-24T17:05:59Z", + "aliases": [ + "CVE-2020-5504" + ], + "summary": "phpMyAdmin SQL injection in user accounts page", + "details": "In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.9.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5504" + }, + { + "type": "WEB", + "url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-5504.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/phpmyadmin/composer" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html" + }, + { + "type": "WEB", + "url": "https://www.phpmyadmin.net/security/PMASA-2020-1" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T17:11:13Z", + "nvd_published_at": "2020-01-09T22:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json b/advisories/unreviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json deleted file mode 100644 index 0b3b1fb6d7d..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-6349-53vr-7hcr/GHSA-6349-53vr-7hcr.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6349-53vr-7hcr", - "modified": "2022-05-24T17:30:27Z", - "published": "2022-05-24T17:30:27Z", - "aliases": [ - "CVE-2020-26934" - ], - "details": "phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26934" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5" - }, - { - "type": "WEB", - "url": "https://security.gentoo.org/glsa/202101-35" - }, - { - "type": "WEB", - "url": "https://www.phpmyadmin.net/security/PMASA-2020-5" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-10-10T19:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json b/advisories/unreviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json deleted file mode 100644 index de2d61ff8cf..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-fgj8-93xx-f6g6/GHSA-fgj8-93xx-f6g6.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fgj8-93xx-f6g6", - "modified": "2022-05-24T17:05:59Z", - "published": "2022-05-24T17:05:59Z", - "aliases": [ - "CVE-2020-5504" - ], - "details": "In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5504" - }, - { - "type": "WEB", - "url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html" - }, - { - "type": "WEB", - "url": "https://www.phpmyadmin.net/security/PMASA-2020-1" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-01-09T22:15:00Z" - } -} \ No newline at end of file