From b2fdc73e0af9fec26ee3396db5d13e820f4f1fd4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 13 Mar 2025 19:13:03 +0000 Subject: [PATCH] Publish Advisories GHSA-52g6-pfrq-rxfv GHSA-ghjw-fc9q-jj8c --- .../GHSA-52g6-pfrq-rxfv.json | 54 ++++++++++++++----- .../GHSA-ghjw-fc9q-jj8c.json | 48 +++++++++++++---- 2 files changed, 79 insertions(+), 23 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json (55%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json (56%) diff --git a/advisories/unreviewed/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json b/advisories/github-reviewed/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json similarity index 55% rename from advisories/unreviewed/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json rename to advisories/github-reviewed/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json index 6f3f0eb9904..ebcafe7c255 100644 --- a/advisories/unreviewed/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json +++ b/advisories/github-reviewed/2022/05/GHSA-52g6-pfrq-rxfv/GHSA-52g6-pfrq-rxfv.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-52g6-pfrq-rxfv", - "modified": "2022-05-17T01:31:21Z", + "modified": "2025-03-13T19:11:25Z", "published": "2022-05-17T01:31:21Z", "aliases": [ "CVE-2013-5573" ], + "summary": "Jenkins allows Cross-Site Scripting (XSS) in User Configuration", "details": "Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.523" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,6 +44,14 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89872" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200229071540/http://www.securityfocus.com/bid/64414" + }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/124513" @@ -33,23 +67,15 @@ { "type": "WEB", "url": "http://www.exploit-db.com/exploits/30408" - }, - { - "type": "WEB", - "url": "http://www.osvdb.org/101187" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/64414" } ], "database_specific": { "cwe_ids": [ "CWE-79" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:11:25Z", "nvd_published_at": "2013-12-31T16:04:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json b/advisories/github-reviewed/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json rename to advisories/github-reviewed/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json index 17804d02dbe..eee2ce2b18c 100644 --- a/advisories/unreviewed/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json +++ b/advisories/github-reviewed/2022/05/GHSA-ghjw-fc9q-jj8c/GHSA-ghjw-fc9q-jj8c.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-ghjw-fc9q-jj8c", - "modified": "2022-05-17T03:51:00Z", + "modified": "2025-03-13T19:12:32Z", "published": "2022-05-17T03:51:00Z", "aliases": [ "CVE-2014-3678" ], + "summary": "Jenkins Monitoring Plugin allows Cross-Site Scripting (XSS)", "details": "Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:monitoring" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.53.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3678" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/monitoring-plugin/commit/f0f6aeef2032696c97d4b015dd51fa2b841b0473" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHBA-2014:1630" @@ -26,6 +56,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147760" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/monitoring-plugin" + }, { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/JENKINS/Monitoring" @@ -33,10 +67,6 @@ { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/59122" } ], "database_specific": { @@ -44,8 +74,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:12:32Z", "nvd_published_at": "2014-10-10T14:55:00Z" } } \ No newline at end of file