netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7wmp-2xmx-g6h8
GHSA-jpf2-9ppp-2c49
GHSA-7wmp-2xmx-g6h8
GHSA-jpf2-9ppp-2c49
This commit is contained in:
advisory-database[bot]
2024-11-12 21:26:32 +00:00
parent 3ad9c1361a
commit b917f2c700
4 changed files with 203 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/11/GHSA-7wmp-2xmx-g6h8/GHSA-7wmp-2xmx-g6h8.json
+130
View File
@@ -0,0 +1,130 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7wmp-2xmx-g6h8",
"modified": "2024-11-12T21:25:46Z",
"published": "2024-11-11T15:31:00Z",
"aliases": [
"CVE-2024-43432"
],
"summary": "Moodle authorization headers preserved between \"emulated redirects\"",
"details": "A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.12"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43432"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304260"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=461200"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82136"
}
],
"database_specific": {
"cwe_ids": [
"CWE-319"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-11-12T21:25:46Z",
"nvd_published_at": "2024-11-11T13:15:04Z"
}
}
advisories/github-reviewed/2024/11/GHSA-jpf2-9ppp-2c49/GHSA-jpf2-9ppp-2c49.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jpf2-9ppp-2c49",
"modified": "2024-11-12T21:25:09Z",
"published": "2024-11-11T15:31:00Z",
"aliases": [
"CVE-2024-43430"
],
"summary": "Moodle has insufficient access control",
"details": "A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43430"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304258"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=461198"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82633"
}
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-11-12T21:25:09Z",
"nvd_published_at": "2024-11-11T13:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-7wmp-2xmx-g6h8/GHSA-7wmp-2xmx-g6h8.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7wmp-2xmx-g6h8",
"modified": "2024-11-11T15:31:00Z",
"published": "2024-11-11T15:31:00Z",
"aliases": [
"CVE-2024-43432"
],
"details": "A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43432"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304260"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=461200"
}
],
"database_specific": {
"cwe_ids": [
"CWE-319"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T13:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-jpf2-9ppp-2c49/GHSA-jpf2-9ppp-2c49.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jpf2-9ppp-2c49",
"modified": "2024-11-11T15:31:00Z",
"published": "2024-11-11T15:31:00Z",
"aliases": [
"CVE-2024-43430"
],
"details": "A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43430"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304258"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=461198"
}
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T13:15:04Z"
}
}