From aeed305519a5c7444e208a1c44e395d904a984ce Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 28 Feb 2024 18:58:27 +0000 Subject: [PATCH] Publish Advisories GHSA-mpv3-g527-fqrj GHSA-8mq4-9jjh-9xrc GHSA-wr6g-9wcr-cmqj GHSA-mpv3-g527-fqrj GHSA-wr6g-9wcr-cmqj --- .../GHSA-mpv3-g527-fqrj.json | 77 ++++++++++++++++ .../GHSA-8mq4-9jjh-9xrc.json | 64 ++++++++++++++ .../GHSA-wr6g-9wcr-cmqj.json | 87 +++++++++++++++++++ .../GHSA-mpv3-g527-fqrj.json | 42 --------- .../GHSA-wr6g-9wcr-cmqj.json | 38 -------- 5 files changed, 228 insertions(+), 80 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-8mq4-9jjh-9xrc/GHSA-8mq4-9jjh-9xrc.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json diff --git a/advisories/github-reviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json b/advisories/github-reviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json new file mode 100644 index 00000000000..7f15ce3a239 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mpv3-g527-fqrj", + "modified": "2024-02-28T18:56:58Z", + "published": "2022-05-13T01:07:00Z", + "aliases": [ + "CVE-2015-5170" + ], + "summary": "Cloud Foundry Runtime Cross-Site Request Forgery vulnerability", + "details": "Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.cloudfoundry.identity:cloudfoundry-identity-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5170" + }, + { + "type": "WEB", + "url": "https://github.com/cloudfoundry/uaa/commit/41dba9d81dbdf24ede4fb9719de28b1b88b3e1b4" + }, + { + "type": "WEB", + "url": "https://github.com/cloudfoundry/uaa/commit/a54f3fb8225ef7d5021ca7d4fb52bef1e884568e" + }, + { + "type": "WEB", + "url": "https://github.com/cloudfoundry/uaa/commit/bdb1a39a1e72f615f2e7a429a896a11e7ee5ec17" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cloudfoundry/uaa" + }, + { + "type": "WEB", + "url": "https://pivotal.io/security/cve-2015-5170-5173" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/101579" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-28T18:56:58Z", + "nvd_published_at": "2017-10-24T17:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-8mq4-9jjh-9xrc/GHSA-8mq4-9jjh-9xrc.json b/advisories/github-reviewed/2024/02/GHSA-8mq4-9jjh-9xrc/GHSA-8mq4-9jjh-9xrc.json new file mode 100644 index 00000000000..e8b5b5e9e17 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-8mq4-9jjh-9xrc/GHSA-8mq4-9jjh-9xrc.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8mq4-9jjh-9xrc", + "modified": "2024-02-28T18:57:19Z", + "published": "2024-02-28T18:57:19Z", + "aliases": [ + + ], + "summary": "YARD's default template vulnerable to Cross-site Scripting in generated frames.html", + "details": "### Summary\nThe \"frames.html\" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the \"frames.erb\" template file.\n\n### Details\nThe vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the \"frames.erb\" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.\n\nSnippet from \"frames.erb\":\n```erb\n\n```\n\n### PoC (Proof of Concept)\nTo exploit this vulnerability:\n1. Gain access to the generated Yard Doc.\n2. Locate and access the \"frames.html\" file.\n3. Construct a URL containing the malicious payload in the hash segment, for instance: `#!javascript:xss`\n\n### Impact\nThis XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "yard" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.35" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.9.34" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc" + }, + { + "type": "WEB", + "url": "https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lsegal/yard" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-28T18:57:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json b/advisories/github-reviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json new file mode 100644 index 00000000000..85f319b8973 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json @@ -0,0 +1,87 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wr6g-9wcr-cmqj", + "modified": "2024-02-28T18:57:02Z", + "published": "2024-02-28T12:30:27Z", + "aliases": [ + "CVE-2024-24779" + ], + "summary": "Apache Superset: Improper data authorization when creating a new dataset", + "details": "Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.\nThis issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.\n\nUsers are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "apache-superset" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.0.3" + } + }, + { + "package": { + "ecosystem": "PyPI", + "name": "apache-superset" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.0" + }, + { + "fixed": "3.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24779" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/superset" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/xzhz1m5bb9zxhyqgoy4q2d689b3zp4pq" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/28/6" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-28T18:57:02Z", + "nvd_published_at": "2024-02-28T12:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json b/advisories/unreviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json deleted file mode 100644 index 033a86e97fb..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-mpv3-g527-fqrj/GHSA-mpv3-g527-fqrj.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mpv3-g527-fqrj", - "modified": "2022-05-13T01:07:00Z", - "published": "2022-05-13T01:07:00Z", - "aliases": [ - "CVE-2015-5170" - ], - "details": "Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5170" - }, - { - "type": "WEB", - "url": "https://pivotal.io/security/cve-2015-5170-5173" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/101579" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-10-24T17:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json b/advisories/unreviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json deleted file mode 100644 index ce887611376..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-wr6g-9wcr-cmqj/GHSA-wr6g-9wcr-cmqj.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wr6g-9wcr-cmqj", - "modified": "2024-02-28T12:30:27Z", - "published": "2024-02-28T12:30:27Z", - "aliases": [ - "CVE-2024-24779" - ], - "details": "Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.\nThis issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.\n\nUsers are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24779" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/xzhz1m5bb9zxhyqgoy4q2d689b3zp4pq" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-28T12:15:47Z" - } -} \ No newline at end of file