diff --git a/advisories/unreviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json b/advisories/github-reviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json similarity index 51% rename from advisories/unreviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json rename to advisories/github-reviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json index c95722721ba..b5221ddc0d7 100644 --- a/advisories/unreviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json +++ b/advisories/github-reviewed/2025/03/GHSA-2cv6-4f2r-jq2c/GHSA-2cv6-4f2r-jq2c.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-2cv6-4f2r-jq2c", - "modified": "2025-03-12T18:32:53Z", + "modified": "2025-03-12T22:08:12Z", "published": "2025-03-12T18:32:53Z", "aliases": [ "CVE-2025-27867" ], + "summary": "Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin ", "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.\n\nThis issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.\n\nUsers are recommended to upgrade to version 1.2.2, which fixes the issue.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.felix:org.apache.felix.http.webconsoleplugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27867" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/felix-dev" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp" @@ -27,9 +57,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-12T22:08:12Z", "nvd_published_at": "2025-03-12T16:15:24Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json b/advisories/github-reviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json similarity index 55% rename from advisories/unreviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json rename to advisories/github-reviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json index df42904c10b..cd21eff4012 100644 --- a/advisories/unreviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json +++ b/advisories/github-reviewed/2025/03/GHSA-35gq-cvrm-xf94/GHSA-35gq-cvrm-xf94.json @@ -1,24 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-35gq-cvrm-xf94", - "modified": "2025-03-12T18:32:53Z", + "modified": "2025-03-12T22:08:29Z", "published": "2025-03-12T18:32:53Z", "aliases": [ "CVE-2025-27017" ], + "summary": "Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record", "details": "Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:L/U:Green" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.nifi:nifi-mongodb-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27017" }, + { + "type": "WEB", + "url": "https://github.com/apache/nifi/commit/48d684500f6ad70f65bfd510db054590c5bc74a9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/nifi" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/NIFI-14272" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q" @@ -33,8 +66,8 @@ "CWE-538" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-12T22:08:29Z", "nvd_published_at": "2025-03-12T17:15:50Z" } } \ No newline at end of file