From b6a0f4a316ccf12a3917802dca25b7933efb944a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 17:25:26 +0000 Subject: [PATCH] Publish Advisories GHSA-phhm-6pgm-mxw9 GHSA-297f-r9w7-w492 GHSA-297f-r9w7-w492 --- .../GHSA-phhm-6pgm-mxw9.json | 38 ++++++- .../GHSA-297f-r9w7-w492.json | 104 ++++++++++++++++++ .../GHSA-297f-r9w7-w492.json | 39 ------- 3 files changed, 138 insertions(+), 43 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json (53%) create mode 100644 advisories/github-reviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json delete mode 100644 advisories/unreviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json diff --git a/advisories/unreviewed/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json b/advisories/github-reviewed/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json rename to advisories/github-reviewed/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json index df1d5d8dc59..8713f2c7119 100644 --- a/advisories/unreviewed/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json +++ b/advisories/github-reviewed/2022/05/GHSA-phhm-6pgm-mxw9/GHSA-phhm-6pgm-mxw9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-phhm-6pgm-mxw9", - "modified": "2022-05-17T02:27:14Z", + "modified": "2024-04-23T17:23:42Z", "published": "2022-05-17T02:27:14Z", "aliases": [ "CVE-2017-1000067" ], + "summary": "MODX Revolution blind SQL injection", "details": "MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.", "severity": [ { @@ -14,13 +15,42 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "modx/revolution" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.6.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.5.6" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000067" }, + { + "type": "PACKAGE", + "url": "https://github.com/modxcms/revolution" + }, + { + "type": "WEB", + "url": "https://github.com/modxcms/revolution/blob/2.x/core/xpdo/changelog.txt#L48" + }, { "type": "WEB", "url": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt" @@ -31,8 +61,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:23:42Z", "nvd_published_at": "2017-07-17T13:18:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json b/advisories/github-reviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json new file mode 100644 index 00000000000..c2d2e657705 --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-297f-r9w7-w492", + "modified": "2024-04-23T17:24:33Z", + "published": "2022-10-20T19:00:29Z", + "aliases": [ + "CVE-2022-42344" + ], + "summary": "Magento Improper input validation vulnerability", + "details": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.7-p4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.4.3-p3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.4" + }, + { + "fixed": "2.4.5" + } + ] + } + ], + "versions": [ + "2.4.4" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42344" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-639", + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:24:33Z", + "nvd_published_at": "2022-10-20T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json b/advisories/unreviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json deleted file mode 100644 index 8f7bcdd30d4..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-297f-r9w7-w492/GHSA-297f-r9w7-w492.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-297f-r9w7-w492", - "modified": "2022-10-20T19:00:29Z", - "published": "2022-10-20T19:00:29Z", - "aliases": [ - "CVE-2022-42344" - ], - "details": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42344" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20", - "CWE-639" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-10-20T17:15:00Z" - } -} \ No newline at end of file