diff --git a/advisories/github-reviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json b/advisories/github-reviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json new file mode 100644 index 00000000000..483e1645581 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jxr4-4prv-mh83", + "modified": "2025-02-27T20:59:12Z", + "published": "2024-07-01T15:32:47Z", + "aliases": [ + "CVE-2024-6376" + ], + "summary": "ejson shell parser in MongoDB Compass maybe bypassed", + "details": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@mongodb-js/connection-form" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.20.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6376" + }, + { + "type": "WEB", + "url": "https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mongodb-js/compass" + }, + { + "type": "WEB", + "url": "https://jira.mongodb.org/browse/COMPASS-7496" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-27T20:59:11Z", + "nvd_published_at": "2024-07-01T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json b/advisories/github-reviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json similarity index 60% rename from advisories/unreviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json rename to advisories/github-reviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json index 51436bd61d0..5370a538e9b 100644 --- a/advisories/unreviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json +++ b/advisories/github-reviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json @@ -1,19 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-f5w3-73h4-jpcm", - "modified": "2025-02-27T18:31:13Z", + "modified": "2025-02-27T20:59:00Z", "published": "2025-02-27T18:31:13Z", "aliases": [ "CVE-2025-1756" ], - "details": "mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\\node_modules\\. This issue affects mongosh prior to 2.3.0", + "summary": "mongosh vulnerable to local privilege escalation", + "details": "mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\\node_modules\\. This issue affects mongosh prior to 2.3.0.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "mongosh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:1756" }, + { + "type": "PACKAGE", + "url": "https://github.com/mongodb-js/mongosh" + }, { "type": "WEB", "url": "https://jira.mongodb.org/browse/MONGOSH-2028" @@ -33,8 +58,8 @@ "CWE-426" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-27T20:59:00Z", "nvd_published_at": "2025-02-27T16:15:39Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json b/advisories/unreviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json deleted file mode 100644 index dfb9e222d8f..00000000000 --- a/advisories/unreviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jxr4-4prv-mh83", - "modified": "2024-07-01T15:32:47Z", - "published": "2024-07-01T15:32:47Z", - "aliases": [ - "CVE-2024-6376" - ], - "details": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6376" - }, - { - "type": "WEB", - "url": "https://jira.mongodb.org/browse/COMPASS-7496" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20", - "CWE-94" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-07-01T15:15:17Z" - } -} \ No newline at end of file