diff --git a/advisories/github-reviewed/2021/10/GHSA-x95h-979x-cf3j/GHSA-x95h-979x-cf3j.json b/advisories/github-reviewed/2021/10/GHSA-x95h-979x-cf3j/GHSA-x95h-979x-cf3j.json index edf1bfd2355..12c28884055 100644 --- a/advisories/github-reviewed/2021/10/GHSA-x95h-979x-cf3j/GHSA-x95h-979x-cf3j.json +++ b/advisories/github-reviewed/2021/10/GHSA-x95h-979x-cf3j/GHSA-x95h-979x-cf3j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x95h-979x-cf3j", - "modified": "2024-05-20T21:29:06Z", + "modified": "2024-10-21T20:18:42Z", "published": "2021-10-19T20:15:30Z", "aliases": [ "CVE-2021-42576" @@ -9,7 +9,14 @@ "summary": "Policies not properly enforced in bluemonday", "details": "The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } ], "affected": [ { @@ -64,20 +71,32 @@ "type": "WEB", "url": "https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-x95h-979x-cf3j" + }, { "type": "PACKAGE", "url": "https://github.com/microcosm-cc/bluemonday" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yaml" + }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2022-0588" + }, + { + "type": "WEB", + "url": "https://pypi.org/project/pybluemonday" } ], "database_specific": { "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2021-10-19T16:10:19Z", "nvd_published_at": "2021-10-18T15:15:00Z"