Publish Advisories

GHSA-2cv6-4f2r-jq2c
GHSA-35gq-cvrm-xf94

advisories/github-reviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json

@@ -1,19 +1,49 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2cv6-4f2r-jq2c",
-  "modified": "2025-03-12T18:32:53Z",
+  "modified": "2025-03-12T22:08:12Z",
   "published": "2025-03-12T18:32:53Z",
   "aliases": [
     "CVE-2025-27867"
   ],
+  "summary": "Apache Felix HTTP Webconsole Plugin:  XSS in HTTP Webconsole Plugin ",
   "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.\n\nThis issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.\n\nUsers are recommended to upgrade to version 1.2.2, which fixes the issue.",
-  "severity": [],
-  "affected": [],
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.felix:org.apache.felix.http.webconsoleplugin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.2.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27867"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/felix-dev"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp"
@@ -27,9 +57,9 @@
     "cwe_ids": [
       "CWE-79"
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-12T22:08:12Z",
     "nvd_published_at": "2025-03-12T16:15:24Z"
   }
 }

advisories/github-reviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json

@@ -1,24 +1,57 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-35gq-cvrm-xf94",
-  "modified": "2025-03-12T18:32:53Z",
+  "modified": "2025-03-12T22:08:29Z",
   "published": "2025-03-12T18:32:53Z",
   "aliases": [
     "CVE-2025-27017"
   ],
+  "summary": "Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record",
   "details": "Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Green"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:L/U:Green"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.nifi:nifi-mongodb-services"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.13.0"
+            },
+            {
+              "fixed": "2.3.0"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27017"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/nifi/commit/48d684500f6ad70f65bfd510db054590c5bc74a9"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/nifi"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.apache.org/jira/browse/NIFI-14272"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q"
@@ -33,8 +66,8 @@
       "CWE-538"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-12T22:08:29Z",
     "nvd_published_at": "2025-03-12T17:15:50Z"
   }
 }