mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-264w-gw9g-fhgj GHSA-g8jw-8vpv-pv5q GHSA-8h22-8cf7-hq6g GHSA-5jfq-x6xp-7rw2 GHSA-9f8f-2vmf-885j GHSA-fx44-2wx5-5fvp GHSA-ggqx-43h2-55jp GHSA-hj4w-hm2g-p6w5 GHSA-pjr6-jx7r-j4r6 GHSA-r9gv-qffm-xw6f GHSA-vc6m-hm49-g9qg GHSA-wc9g-6j9w-hr95 GHSA-xcj6-pq6g-qj4x GHSA-fx44-2wx5-5fvp
This commit is contained in:
advisory-database[bot]
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-264w-gw9g-fhgj",
|
||||
"modified": "2022-11-21T23:56:58Z",
|
||||
"modified": "2025-04-30T17:25:41Z",
|
||||
"published": "2022-11-20T06:30:16Z",
|
||||
"aliases": [
|
||||
"CVE-2022-3561"
|
||||
@@ -44,6 +44,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/librenms/librenms/commit/d86cbcd96d684e4de8dfa50b4490e4e02782d242"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://huntr.com/bounties/7389e6eb-4bce-4b97-999d-d3b70d8cee34"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://huntr.dev/bounties/7389e6eb-4bce-4b97-999d-d3b70d8cee34"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-g8jw-8vpv-pv5q",
|
||||
"modified": "2022-11-23T17:38:30Z",
|
||||
"modified": "2025-04-30T17:25:45Z",
|
||||
"published": "2022-11-21T21:30:14Z",
|
||||
"aliases": [
|
||||
"CVE-2022-42096"
|
||||
@@ -40,6 +40,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42096"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://backdropcms.org"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/backdrop/backdrop/releases/tag/1.23.0"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8h22-8cf7-hq6g",
|
||||
"modified": "2024-06-10T18:30:52Z",
|
||||
"modified": "2025-04-30T17:27:47Z",
|
||||
"published": "2024-02-27T21:41:16Z",
|
||||
"aliases": [
|
||||
"CVE-2024-26144"
|
||||
],
|
||||
"summary": "Rails has possible Sensitive Session Information Leak in Active Storage",
|
||||
"details": "# Possible Sensitive Session Information Leak in Active Storage\n\nThere is a possible sensitive session information leak in Active Storage. By\ndefault, Active Storage sends a `Set-Cookie` header along with the user's\nsession cookie when serving blobs. It also sets `Cache-Control` to public.\nCertain proxies may cache the Set-Cookie, leading to an information leak.\n\nThis vulnerability has been assigned the CVE identifier CVE-2024-26144.\n\nVersions Affected: >= 5.2.0, < 7.1.0\nNot affected: < 5.2.0, > 7.1.0\nFixed Versions: 7.0.8.1, 6.1.7.7\n\nImpact\n------\nA proxy which chooses to caches this request can cause users to share\nsessions. This may include a user receiving an attacker's session or vice\nversa.\n\nThis was patched in 7.1.0 but not previously identified as a security\nvulnerability.\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nUpgrade to Rails 7.1.X, or configure caching proxies not to cache the\nSet-Cookie headers.\n\nCredits\n-------\n\nThanks to [tyage](https://hackerone.com/tyage) for reporting this!\n",
|
||||
"details": "# Possible Sensitive Session Information Leak in Active Storage\n\nThere is a possible sensitive session information leak in Active Storage. By\ndefault, Active Storage sends a `Set-Cookie` header along with the user's\nsession cookie when serving blobs. It also sets `Cache-Control` to public.\nCertain proxies may cache the Set-Cookie, leading to an information leak.\n\nThis vulnerability has been assigned the CVE identifier CVE-2024-26144.\n\nVersions Affected: >= 5.2.0, < 7.1.0\nNot affected: < 5.2.0, > 7.1.0\nFixed Versions: 7.0.8.1, 6.1.7.7\n\nImpact\n------\nA proxy which chooses to caches this request can cause users to share\nsessions. This may include a user receiving an attacker's session or vice\nversa.\n\nThis was patched in 7.1.0 but not previously identified as a security\nvulnerability.\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nUpgrade to Rails 7.1.X, or configure caching proxies not to cache the\nSet-Cookie headers.\n\nCredits\n-------\n\nThanks to [tyage](https://hackerone.com/tyage) for reporting this!",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5jfq-x6xp-7rw2",
|
||||
"modified": "2025-04-30T17:26:13Z",
|
||||
"published": "2025-04-30T17:26:13Z",
|
||||
"aliases": [
|
||||
"CVE-2025-3910"
|
||||
],
|
||||
"summary": "Keycloak vulnerable to two factor authentication bypass",
|
||||
"details": "# Description\nA flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Maven",
|
||||
"name": "org.keycloak:keycloak-services"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "26.2.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-5jfq-x6xp-7rw2"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3910"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2025:4335"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2025:4336"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2025-3910"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361923"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/keycloak/keycloak"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-287"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-30T17:26:13Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9f8f-2vmf-885j",
|
||||
"modified": "2025-04-29T14:50:59Z",
|
||||
"modified": "2025-04-30T17:26:58Z",
|
||||
"published": "2025-04-29T14:50:59Z",
|
||||
"aliases": [
|
||||
"CVE-2025-30202"
|
||||
@@ -40,6 +40,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-9f8f-2vmf-885j"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30202"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vllm-project/vllm/pull/6183"
|
||||
@@ -60,6 +64,6 @@
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T14:50:59Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-30T01:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fx44-2wx5-5fvp",
|
||||
"modified": "2025-04-30T17:25:51Z",
|
||||
"published": "2025-04-29T21:31:56Z",
|
||||
"withdrawn": "2025-04-30T17:25:51Z",
|
||||
"aliases": [],
|
||||
"summary": "Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass",
|
||||
"details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references.\n\n# Original Description\nA flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Maven",
|
||||
"name": "org.keycloak:keycloak-services"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "26.2.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3910"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2025:4335"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2025:4336"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2025-3910"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361923"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-287"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-30T17:25:51Z",
|
||||
"nvd_published_at": "2025-04-29T21:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-ggqx-43h2-55jp",
|
||||
"modified": "2025-04-29T14:36:10Z",
|
||||
"modified": "2025-04-30T17:26:08Z",
|
||||
"published": "2025-04-29T14:36:10Z",
|
||||
"aliases": [
|
||||
"CVE-2025-46550"
|
||||
@@ -43,6 +43,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ggqx-43h2-55jp"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46550"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/YesWiki/yeswiki/commit/4e9e51d80cd024ed2ac5c12c820817e6d8c2655a"
|
||||
@@ -59,6 +63,6 @@
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T14:36:10Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-29T21:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hj4w-hm2g-p6w5",
|
||||
"modified": "2025-04-29T14:52:29Z",
|
||||
"modified": "2025-04-30T17:27:11Z",
|
||||
"published": "2025-04-29T14:52:29Z",
|
||||
"aliases": [
|
||||
"CVE-2025-32444"
|
||||
@@ -44,6 +44,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32444"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vllm-project/vllm/commit/a5450f11c95847cf51a17207af9a3ca5ab569b2c"
|
||||
@@ -64,6 +68,6 @@
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T14:52:29Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-30T01:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-pjr6-jx7r-j4r6",
|
||||
"modified": "2025-04-29T18:54:49Z",
|
||||
"modified": "2025-04-30T17:25:56Z",
|
||||
"published": "2025-04-29T18:54:49Z",
|
||||
"aliases": [
|
||||
"CVE-2025-46344"
|
||||
@@ -40,6 +40,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46344"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3"
|
||||
@@ -60,6 +64,6 @@
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T18:54:49Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-29T21:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-r9gv-qffm-xw6f",
|
||||
"modified": "2025-04-29T14:35:20Z",
|
||||
"modified": "2025-04-30T17:26:05Z",
|
||||
"published": "2025-04-29T14:35:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-46549"
|
||||
@@ -43,6 +43,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r9gv-qffm-xw6f"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46549"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/YesWiki/yeswiki/commit/107d43056adebaa0c731230f9fd010898e88f3f5"
|
||||
@@ -59,6 +63,6 @@
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T14:35:20Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-29T21:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vc6m-hm49-g9qg",
|
||||
"modified": "2025-04-29T20:38:26Z",
|
||||
"modified": "2025-04-30T17:27:16Z",
|
||||
"published": "2025-04-29T16:43:10Z",
|
||||
"aliases": [
|
||||
"CVE-2025-46560"
|
||||
@@ -40,6 +40,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-vc6m-hm49-g9qg"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46560"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/vllm-project/vllm"
|
||||
@@ -56,6 +60,6 @@
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T16:43:10Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-30T01:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-wc9g-6j9w-hr95",
|
||||
"modified": "2025-04-29T14:41:31Z",
|
||||
"modified": "2025-04-30T17:26:00Z",
|
||||
"published": "2025-04-29T14:41:31Z",
|
||||
"aliases": [
|
||||
"CVE-2025-46348"
|
||||
@@ -43,6 +43,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46348"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530"
|
||||
@@ -60,6 +64,6 @@
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-29T14:41:31Z",
|
||||
"nvd_published_at": null
|
||||
"nvd_published_at": "2025-04-29T21:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-xcj6-pq6g-qj4x",
|
||||
"modified": "2025-04-04T14:20:05Z",
|
||||
"modified": "2025-04-30T17:26:53Z",
|
||||
"published": "2025-04-04T14:20:05Z",
|
||||
"aliases": [
|
||||
"CVE-2025-31486"
|
||||
],
|
||||
"summary": "Vite allows server.fs.deny to be bypassed with .svg or relative paths",
|
||||
"details": "### Summary\n\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\n\nOnly apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected..\n\n### Details\n\n#### `.svg`\n\nRequests ending with `.svg` are loaded at this line.\nhttps://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290\nBy adding `?.svg` with `?.wasm?init` or with `sec-fetch-dest: script` header, the restriction was able to bypass.\n\nThis bypass is only possible if the file is smaller than [`build.assetsInlineLimit`](https://vite.dev/config/build-options.html#build-assetsinlinelimit) (default: 4kB) and when using Vite 6.0+.\n\n#### relative paths\n\nThe check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. `../../`).\n\n### PoC\n\n```bash\nnpm create vite@latest\ncd vite-project/\nnpm install\nnpm run dev\n```\n\nsend request to read `etc/passwd`\n\n```bash\ncurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'\n```\n\n```bash\ncurl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'\n```",
|
||||
"details": "### Summary\n\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\n\nOnly apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n\n#### `.svg`\n\nRequests ending with `.svg` are loaded at this line.\nhttps://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290\nBy adding `?.svg` with `?.wasm?init` or with `sec-fetch-dest: script` header, the restriction was able to bypass.\n\nThis bypass is only possible if the file is smaller than [`build.assetsInlineLimit`](https://vite.dev/config/build-options.html#build-assetsinlinelimit) (default: 4kB) and when using Vite 6.0+.\n\n#### relative paths\n\nThe check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. `../../`).\n\n### PoC\n\n```bash\nnpm create vite@latest\ncd vite-project/\nnpm install\nnpm run dev\n```\n\nsend request to read `etc/passwd`\n\n```bash\ncurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'\n```\n\n```bash\ncurl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'\n```",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fx44-2wx5-5fvp",
|
||||
"modified": "2025-04-30T03:30:31Z",
|
||||
"published": "2025-04-29T21:31:56Z",
|
||||
"aliases": [
|
||||
"CVE-2025-3910"
|
||||
],
|
||||
"details": "A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3910"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2025:4335"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2025:4336"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2025-3910"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361923"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-287"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-04-29T21:15:51Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user