From b65989b07f383432e5cd43cf5663cba6a8670961 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 20:20:29 +0000 Subject: [PATCH] Publish Advisories GHSA-3rwj-v7jp-w542 GHSA-jh2j-7248-9p3c GHSA-rp89-32rp-qpq2 GHSA-v47j-rw9h-6m47 --- .../GHSA-3rwj-v7jp-w542.json | 21 +++++++++--- .../GHSA-jh2j-7248-9p3c.json | 30 +++++++++++++---- .../GHSA-rp89-32rp-qpq2.json | 31 ++++++++++++++--- .../GHSA-v47j-rw9h-6m47.json | 33 ++++++++++++++++--- 4 files changed, 95 insertions(+), 20 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json (77%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json (57%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json (69%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json (51%) diff --git a/advisories/unreviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json b/advisories/github-reviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json similarity index 77% rename from advisories/unreviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json rename to advisories/github-reviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json index 0fab39ada68..8f6b278efa1 100644 --- a/advisories/unreviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json +++ b/advisories/github-reviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3rwj-v7jp-w542", - "modified": "2022-05-14T03:14:51Z", + "modified": "2024-04-24T20:18:26Z", "published": "2022-05-14T03:14:51Z", "aliases": [ "CVE-2018-11564" ], + "summary": "Pagekit Stored Cross-site Scripting", "details": "Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to \"/storage/poc.svg\" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "pagekit/pagekit" + }, + "versions": [ + "1.0.13" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11564" }, + { + "type": "PACKAGE", + "url": "https://github.com/pagekit/pagekit" + }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/148001/PageKit-CMS-1.0.13-Cross-Site-Scripting.html" @@ -39,8 +52,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:18:26Z", "nvd_published_at": "2018-06-02T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json b/advisories/github-reviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json rename to advisories/github-reviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json index 3adb0a824c3..68f694f7b4f 100644 --- a/advisories/unreviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json +++ b/advisories/github-reviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json @@ -1,17 +1,29 @@ { "schema_version": "1.4.0", "id": "GHSA-jh2j-7248-9p3c", - "modified": "2022-05-24T16:56:38Z", + "modified": "2024-04-24T20:18:24Z", "published": "2022-05-24T16:56:38Z", "aliases": [ "CVE-2019-16669" ], + "summary": "Pagekit User enumeration", "details": "The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "pagekit/pagekit" + }, + "versions": [ + "1.0.17" + ] + } ], "references": [ { @@ -21,15 +33,19 @@ { "type": "WEB", "url": "https://github.com/pagekit/pagekit/issues/935" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pagekit/pagekit" } ], "database_specific": { "cwe_ids": [ - + "CWE-203" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:18:24Z", "nvd_published_at": "2019-09-21T19:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json b/advisories/github-reviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json similarity index 69% rename from advisories/unreviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json rename to advisories/github-reviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json index 8e2e1cb7361..644889c610c 100644 --- a/advisories/unreviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json +++ b/advisories/github-reviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rp89-32rp-qpq2", - "modified": "2022-05-13T01:12:12Z", + "modified": "2024-04-24T20:18:58Z", "published": "2022-05-13T01:12:12Z", "aliases": [ "CVE-2017-5594" ], + "summary": "Pagekit Weak Password Recovery Mechanism for Forgotten Password", "details": "An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "pagekit/pagekit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.11" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b" }, + { + "type": "PACKAGE", + "url": "https://github.com/pagekit/pagekit" + }, { "type": "WEB", "url": "https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf" @@ -47,8 +70,8 @@ "CWE-640" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:18:58Z", "nvd_published_at": "2017-01-25T18:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json b/advisories/github-reviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json rename to advisories/github-reviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json index 73636931dab..3fc9dc762a2 100644 --- a/advisories/unreviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json +++ b/advisories/github-reviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-v47j-rw9h-6m47", - "modified": "2022-05-14T02:59:33Z", + "modified": "2024-04-24T20:18:57Z", "published": "2022-05-14T02:59:33Z", "aliases": [ "CVE-2018-14381" ], - "details": "Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.", + "summary": "Pagekit open redirect vulnerability", + "details": "Pagekit before 1.0.14 has a `/user/login?redirect=` open redirect vulnerability.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "pagekit/pagekit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.14" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/pagekit/pagekit/issues/905" }, + { + "type": "PACKAGE", + "url": "https://github.com/pagekit/pagekit" + }, { "type": "WEB", "url": "https://github.com/pagekit/pagekit/releases/tag/1.0.14" @@ -35,8 +58,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:18:57Z", "nvd_published_at": "2018-07-18T15:29:00Z" } } \ No newline at end of file