From c3f2b9046235b1e7e8700c63156c773a80752b6c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 12 Apr 2025 01:48:32 +0000 Subject: [PATCH] Publish Advisories GHSA-gmc7-jvv7-w245 GHSA-wcmm-28rg-mg3r --- .../GHSA-gmc7-jvv7-w245.json | 62 ++++++++++-------- .../GHSA-wcmm-28rg-mg3r.json | 63 +++++++++++++++---- 2 files changed, 86 insertions(+), 39 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json (60%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json (61%) diff --git a/advisories/unreviewed/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json b/advisories/github-reviewed/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json rename to advisories/github-reviewed/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json index 4e425b1d5c2..432e985c964 100644 --- a/advisories/unreviewed/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json +++ b/advisories/github-reviewed/2022/05/GHSA-gmc7-jvv7-w245/GHSA-gmc7-jvv7-w245.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-gmc7-jvv7-w245", - "modified": "2025-04-11T03:42:04Z", + "modified": "2025-04-12T01:46:37Z", "published": "2022-05-17T05:44:04Z", "aliases": [ "CVE-2010-4481" ], + "summary": "phpMyAdmin allows remote attackers to bypass authentication and obtain sensitive information", "details": "phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.0-beta1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4481" }, + { + "type": "PACKAGE", + "url": "https://github.com/phpmyadmin/phpmyadmin" + }, { "type": "WEB", "url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c" @@ -22,14 +52,6 @@ "type": "WEB", "url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=4d9fd005671b05c4d74615d5939ed45e4d019e4c" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/42485" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/42725" - }, { "type": "WEB", "url": "http://www.debian.org/security/2010/dsa-2139" @@ -41,27 +63,15 @@ { "type": "WEB", "url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/3238" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2011/0001" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2011/0027" } ], "database_specific": { "cwe_ids": [ "CWE-287" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T01:46:37Z", "nvd_published_at": "2010-12-17T19:00:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json b/advisories/github-reviewed/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json rename to advisories/github-reviewed/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json index 53e40a3cd73..73328d22cf7 100644 --- a/advisories/unreviewed/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json +++ b/advisories/github-reviewed/2022/05/GHSA-wcmm-28rg-mg3r/GHSA-wcmm-28rg-mg3r.json @@ -1,14 +1,54 @@ { "schema_version": "1.4.0", "id": "GHSA-wcmm-28rg-mg3r", - "modified": "2025-04-11T03:44:06Z", + "modified": "2025-04-12T01:47:30Z", "published": "2022-05-17T02:01:32Z", "aliases": [ "CVE-2011-0986" ], + "summary": "phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file", "details": "phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.", "severity": [], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.11.11.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3.0" + }, + { + "fixed": "3.3.9.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,6 +58,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65424" }, + { + "type": "PACKAGE", + "url": "https://github.com/phpmyadmin/phpmyadmin" + }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html" @@ -34,10 +78,6 @@ "type": "WEB", "url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=035d002db1e1201e73e560d7d98591563b506a83" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/43478" - }, { "type": "WEB", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026" @@ -45,19 +85,16 @@ { "type": "WEB", "url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2011/0385" } ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T01:47:30Z", "nvd_published_at": "2011-02-14T22:00:00Z" } } \ No newline at end of file