From c41f1b3ba1fcdf37c2cad04f50ebc7bc8e6f4953 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 23:42:31 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-2phx-w35g-x9vm.json | 122 ++++++++++++++++ .../GHSA-45rw-4r25-jvg7.json | 103 ++++++++++++++ .../GHSA-5w4h-xrr5-7273.json | 126 ++++++++++++++++ .../GHSA-cjrf-xg77-chpw.json | 122 ++++++++++++++++ .../GHSA-g96h-wvrm-c2ww.json | 126 ++++++++++++++++ .../GHSA-gj2j-ppjq-9pjg.json | 69 ++++++++- .../GHSA-hpwm-84h5-vqr8.json | 103 ++++++++++++++ .../GHSA-jp4g-r8c9-3534.json | 31 +++- .../GHSA-qh8m-6g4p-33h3.json | 50 ++++++- .../GHSA-v9xq-vh72-chr4.json | 126 ++++++++++++++++ .../GHSA-vxmv-74rf-vqgp.json | 122 ++++++++++++++++ .../GHSA-vxqh-mx28-7ghw.json | 122 ++++++++++++++++ .../GHSA-xh2j-q4mc-v522.json | 126 ++++++++++++++++ .../GHSA-xj5f-qv37-r9jc.json | 134 ++++++++++++++++++ .../GHSA-xjx9-7c29-pwmm.json | 122 ++++++++++++++++ .../GHSA-2phx-w35g-x9vm.json | 42 ------ .../GHSA-45rw-4r25-jvg7.json | 42 ------ .../GHSA-5w4h-xrr5-7273.json | 46 ------ .../GHSA-cjrf-xg77-chpw.json | 42 ------ .../GHSA-g96h-wvrm-c2ww.json | 46 ------ .../GHSA-hpwm-84h5-vqr8.json | 42 ------ .../GHSA-v9xq-vh72-chr4.json | 46 ------ .../GHSA-vxmv-74rf-vqgp.json | 42 ------ .../GHSA-vxqh-mx28-7ghw.json | 42 ------ .../GHSA-xh2j-q4mc-v522.json | 46 ------ .../GHSA-xj5f-qv37-r9jc.json | 54 ------- .../GHSA-xjx9-7c29-pwmm.json | 42 ------ 27 files changed, 1592 insertions(+), 544 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json (53%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json (66%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json (53%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json diff --git a/advisories/github-reviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json b/advisories/github-reviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json new file mode 100644 index 00000000000..fcd8138243e --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2phx-w35g-x9vm", + "modified": "2024-04-23T23:41:16Z", + "published": "2022-05-13T01:12:40Z", + "aliases": [ + "CVE-2016-7038" + ], + "summary": "Moodle Weak Password Recovery Mechanism for Forgotten Password", + "details": "In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9" + }, + { + "fixed": "2.9.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7038" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=339631" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/93174" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-640" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:16Z", + "nvd_published_at": "2017-01-20T08:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json b/advisories/github-reviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json new file mode 100644 index 00000000000..3a69c6f6295 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-45rw-4r25-jvg7", + "modified": "2024-04-23T23:41:57Z", + "published": "2022-05-13T01:05:22Z", + "aliases": [ + "CVE-2019-3848" + ], + "summary": "Moodle Logged in users could view all calendar events", + "details": "A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6" + }, + { + "fixed": "3.6.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3848" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=384011#p1547743" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:57Z", + "nvd_published_at": "2019-03-26T18:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json b/advisories/github-reviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json new file mode 100644 index 00000000000..e06aba96fab --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5w4h-xrr5-7273", + "modified": "2024-04-23T23:41:46Z", + "published": "2022-05-13T01:34:55Z", + "aliases": [ + "CVE-2018-10890" + ], + "summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor", + "details": "A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.5.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10890" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=373370" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/104738" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:46Z", + "nvd_published_at": "2018-07-10T18:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json b/advisories/github-reviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json new file mode 100644 index 00000000000..b7a880727de --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cjrf-xg77-chpw", + "modified": "2024-04-23T23:41:20Z", + "published": "2022-05-13T01:12:40Z", + "aliases": [ + "CVE-2017-2576" + ], + "summary": "Moodle Incorrect sanitation of attributes in forums", + "details": "In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.18" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2576" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=345912" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/95649" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:20Z", + "nvd_published_at": "2017-01-20T08:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json b/advisories/github-reviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json new file mode 100644 index 00000000000..9b641539074 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g96h-wvrm-c2ww", + "modified": "2024-04-23T23:41:12Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-3729" + ], + "summary": "Moodle Improper Access Control", + "details": "The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9" + }, + { + "fixed": "2.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8" + }, + { + "fixed": "2.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.14" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3729" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335933" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/05/17/4" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1035902" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:12Z", + "nvd_published_at": "2017-04-20T21:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json b/advisories/github-reviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json rename to advisories/github-reviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json index c265b1d80a9..2dbbdf27ff6 100644 --- a/advisories/unreviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json +++ b/advisories/github-reviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gj2j-ppjq-9pjg", - "modified": "2022-05-13T01:12:38Z", + "modified": "2024-04-23T23:41:09Z", "published": "2022-05-13T01:12:38Z", "aliases": [ "CVE-2016-0725" ], + "summary": "Moodle Cross-site scripting (XSS) vulnerability in course management search", "details": "Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.", "severity": [ { @@ -14,13 +15,73 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8" + }, + { + "fixed": "2.8.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9" + }, + { + "fixed": "2.9.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0725" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=326206" @@ -51,8 +112,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:09Z", "nvd_published_at": "2016-02-22T05:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json b/advisories/github-reviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json new file mode 100644 index 00000000000..e8c18efa73a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpwm-84h5-vqr8", + "modified": "2024-04-23T23:41:49Z", + "published": "2022-05-13T01:48:49Z", + "aliases": [ + "CVE-2018-1043" + ], + "summary": "Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames", + "details": "In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1043" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=364382" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/102769" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:49Z", + "nvd_published_at": "2018-01-22T08:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json b/advisories/github-reviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json rename to advisories/github-reviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json index d3a4fd18fe6..aaf649d3ede 100644 --- a/advisories/unreviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json +++ b/advisories/github-reviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jp4g-r8c9-3534", - "modified": "2022-05-13T01:31:16Z", + "modified": "2024-04-23T23:41:33Z", "published": "2022-05-13T01:31:16Z", "aliases": [ "CVE-2019-3809" ], + "summary": "Moodle Blind SSRF Risk in /badges/mybackpack.php", "details": "A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.16" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=381229#p1536766" @@ -39,8 +62,8 @@ "CWE-918" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:33Z", "nvd_published_at": "2019-03-25T18:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json b/advisories/github-reviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json rename to advisories/github-reviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json index 4cd98bc1af7..59772ff7ef6 100644 --- a/advisories/unreviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json +++ b/advisories/github-reviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qh8m-6g4p-33h3", - "modified": "2022-05-13T01:33:33Z", + "modified": "2024-04-23T23:41:39Z", "published": "2022-05-13T01:33:33Z", "aliases": [ "CVE-2018-1082" ], + "summary": "Moodle Improper Authentication", "details": "A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.", "severity": [ { @@ -14,13 +15,54 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1082" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=367939" @@ -39,8 +81,8 @@ "CWE-287" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:39Z", "nvd_published_at": "2018-04-04T21:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json b/advisories/github-reviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json new file mode 100644 index 00000000000..6b1f85e3519 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9xq-vh72-chr4", + "modified": "2024-04-23T23:41:24Z", + "published": "2022-05-13T01:17:55Z", + "aliases": [ + "CVE-2018-1081" + ], + "summary": "Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script", + "details": "A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1081" + }, + { + "type": "WEB", + "url": "https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=367938" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/103728" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:24Z", + "nvd_published_at": "2018-04-04T21:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json b/advisories/github-reviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json new file mode 100644 index 00000000000..34a8f4b75d4 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxmv-74rf-vqgp", + "modified": "2024-04-23T23:42:05Z", + "published": "2022-05-14T03:16:24Z", + "aliases": [ + "CVE-2018-1135" + ], + "summary": "Moodle Portfolio forum caller class allows a user to download any file", + "details": "An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1135" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=371201" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/104307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:42:05Z", + "nvd_published_at": "2018-05-25T12:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json b/advisories/github-reviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json new file mode 100644 index 00000000000..32b4d7ddc90 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxqh-mx28-7ghw", + "modified": "2024-04-23T23:42:01Z", + "published": "2022-05-14T03:16:23Z", + "aliases": [ + "CVE-2018-1137" + ], + "summary": "Moodle Portfolio script allows instantiation of class chosen by user", + "details": "An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1137" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=371204" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/104307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:42:01Z", + "nvd_published_at": "2018-05-25T12:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json b/advisories/github-reviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json new file mode 100644 index 00000000000..e44667295c4 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xh2j-q4mc-v522", + "modified": "2024-04-23T23:41:29Z", + "published": "2022-05-13T01:18:54Z", + "aliases": [ + "CVE-2018-1133" + ], + "summary": "Moodle calculated question type allows remote code execution by Question authors", + "details": "An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1133" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=371199" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/46551" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/104307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:29Z", + "nvd_published_at": "2018-05-25T12:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json b/advisories/github-reviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json new file mode 100644 index 00000000000..32821829b2a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json @@ -0,0 +1,134 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xj5f-qv37-r9jc", + "modified": "2024-04-23T23:41:43Z", + "published": "2022-05-13T01:34:04Z", + "aliases": [ + "CVE-2018-16854" + ], + "summary": "Moodle Login CSRF vulnerability in login form", + "details": "A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.15" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16854" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16854" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=378731" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-63183" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/106017" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1042154" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:42Z", + "nvd_published_at": "2018-11-26T17:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json b/advisories/github-reviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json new file mode 100644 index 00000000000..5b5ed3432b8 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjx9-7c29-pwmm", + "modified": "2024-04-23T23:41:52Z", + "published": "2022-05-13T01:49:11Z", + "aliases": [ + "CVE-2018-1134" + ], + "summary": "Moodle Improper Privilege Management ", + "details": "An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1134" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=371200" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/104307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:41:52Z", + "nvd_published_at": "2018-05-25T12:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json b/advisories/unreviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json deleted file mode 100644 index 8fb9ed3b3d0..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2phx-w35g-x9vm", - "modified": "2022-05-13T01:12:40Z", - "published": "2022-05-13T01:12:40Z", - "aliases": [ - "CVE-2016-7038" - ], - "details": "In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7038" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=339631" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/93174" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-640" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-01-20T08:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json b/advisories/unreviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json deleted file mode 100644 index 3f6dd0418d3..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-45rw-4r25-jvg7", - "modified": "2022-05-13T01:05:22Z", - "published": "2022-05-13T01:05:22Z", - "aliases": [ - "CVE-2019-3848" - ], - "details": "A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3848" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=384011#p1547743" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-03-26T18:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json b/advisories/unreviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json deleted file mode 100644 index 4b04952e6ce..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5w4h-xrr5-7273", - "modified": "2022-05-13T01:34:55Z", - "published": "2022-05-13T01:34:55Z", - "aliases": [ - "CVE-2018-10890" - ], - "details": "A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10890" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=373370" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/104738" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-07-10T18:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json b/advisories/unreviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json deleted file mode 100644 index 3129b268843..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-cjrf-xg77-chpw", - "modified": "2022-05-13T01:12:40Z", - "published": "2022-05-13T01:12:40Z", - "aliases": [ - "CVE-2017-2576" - ], - "details": "In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2576" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=345912" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/95649" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-01-20T08:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json b/advisories/unreviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json deleted file mode 100644 index d4d6e28fb35..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-g96h-wvrm-c2ww", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-3729" - ], - "details": "The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3729" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335933" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/05/17/4" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035902" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-04-20T21:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json b/advisories/unreviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json deleted file mode 100644 index 62ff7422c6e..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hpwm-84h5-vqr8", - "modified": "2022-05-13T01:48:49Z", - "published": "2022-05-13T01:48:49Z", - "aliases": [ - "CVE-2018-1043" - ], - "details": "In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1043" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=364382" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/102769" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-01-22T08:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json b/advisories/unreviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json deleted file mode 100644 index 8557b08fd4c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v9xq-vh72-chr4", - "modified": "2022-05-13T01:17:55Z", - "published": "2022-05-13T01:17:55Z", - "aliases": [ - "CVE-2018-1081" - ], - "details": "A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1081" - }, - { - "type": "WEB", - "url": "https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=367938" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/103728" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-04-04T21:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json b/advisories/unreviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json deleted file mode 100644 index 13cbc05272c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vxmv-74rf-vqgp", - "modified": "2022-05-14T03:16:24Z", - "published": "2022-05-14T03:16:24Z", - "aliases": [ - "CVE-2018-1135" - ], - "details": "An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1135" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=371201" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/104307" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-05-25T12:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json b/advisories/unreviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json deleted file mode 100644 index 0a0dadcd0f6..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vxqh-mx28-7ghw", - "modified": "2022-05-14T03:16:23Z", - "published": "2022-05-14T03:16:23Z", - "aliases": [ - "CVE-2018-1137" - ], - "details": "An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1137" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=371204" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/104307" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-05-25T12:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json b/advisories/unreviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json deleted file mode 100644 index fb26fba43a4..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xh2j-q4mc-v522", - "modified": "2022-05-13T01:18:54Z", - "published": "2022-05-13T01:18:54Z", - "aliases": [ - "CVE-2018-1133" - ], - "details": "An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1133" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=371199" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/46551" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/104307" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-05-25T12:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json b/advisories/unreviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json deleted file mode 100644 index dae94e87b41..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xj5f-qv37-r9jc", - "modified": "2022-05-13T01:34:04Z", - "published": "2022-05-13T01:34:04Z", - "aliases": [ - "CVE-2018-16854" - ], - "details": "A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16854" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16854" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=378731" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-63183" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/106017" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1042154" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-11-26T17:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json b/advisories/unreviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json deleted file mode 100644 index cf22c25574a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xjx9-7c29-pwmm", - "modified": "2022-05-13T01:49:11Z", - "published": "2022-05-13T01:49:11Z", - "aliases": [ - "CVE-2018-1134" - ], - "details": "An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1134" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=371200" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/104307" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-269" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-05-25T12:29:00Z" - } -} \ No newline at end of file