diff --git a/advisories/unreviewed/2022/05/GHSA-53pj-67m4-9w98/GHSA-53pj-67m4-9w98.json b/advisories/github-reviewed/2022/05/GHSA-53pj-67m4-9w98/GHSA-53pj-67m4-9w98.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-53pj-67m4-9w98/GHSA-53pj-67m4-9w98.json rename to advisories/github-reviewed/2022/05/GHSA-53pj-67m4-9w98/GHSA-53pj-67m4-9w98.json index a8a351b138e..b4ee43b4645 100644 --- a/advisories/unreviewed/2022/05/GHSA-53pj-67m4-9w98/GHSA-53pj-67m4-9w98.json +++ b/advisories/github-reviewed/2022/05/GHSA-53pj-67m4-9w98/GHSA-53pj-67m4-9w98.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-53pj-67m4-9w98", - "modified": "2022-05-24T16:47:29Z", + "modified": "2024-04-24T21:01:44Z", "published": "2022-05-24T16:47:29Z", "aliases": [ "CVE-2019-12303" ], + "summary": "Rancher code injection via fluentd config commands", "details": "In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.2.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.2.3" + } + } ], "references": [ { @@ -23,11 +45,11 @@ }, { "type": "WEB", - "url": "https://forums.rancher.com/c/announcements" + "url": "https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466" }, { - "type": "WEB", - "url": "https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466" + "type": "PACKAGE", + "url": "https://github.com/rancher/rancher" } ], "database_specific": { @@ -35,8 +57,8 @@ "CWE-74" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:01:44Z", "nvd_published_at": "2019-06-06T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-fcgf-j8cf-h2rm/GHSA-fcgf-j8cf-h2rm.json b/advisories/github-reviewed/2022/11/GHSA-fcgf-j8cf-h2rm/GHSA-fcgf-j8cf-h2rm.json similarity index 59% rename from advisories/unreviewed/2022/11/GHSA-fcgf-j8cf-h2rm/GHSA-fcgf-j8cf-h2rm.json rename to advisories/github-reviewed/2022/11/GHSA-fcgf-j8cf-h2rm/GHSA-fcgf-j8cf-h2rm.json index 008a565b0c0..bf7eda19ac0 100644 --- a/advisories/unreviewed/2022/11/GHSA-fcgf-j8cf-h2rm/GHSA-fcgf-j8cf-h2rm.json +++ b/advisories/github-reviewed/2022/11/GHSA-fcgf-j8cf-h2rm/GHSA-fcgf-j8cf-h2rm.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fcgf-j8cf-h2rm", - "modified": "2022-11-02T19:00:31Z", + "modified": "2024-04-24T21:01:02Z", "published": "2022-11-01T19:00:29Z", "aliases": [ "CVE-2022-3799" ], + "summary": "IBAX go-ibax vulnerable to SQL injection", "details": "A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/IBAX-io/go-ibax" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,14 @@ "type": "WEB", "url": "https://github.com/IBAX-io/go-ibax/issues/2060" }, + { + "type": "WEB", + "url": "https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/IBAX-io/go-ibax" + }, { "type": "WEB", "url": "https://vuldb.com/?id.212635" @@ -35,8 +62,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:01:02Z", "nvd_published_at": "2022-11-01T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/11/GHSA-g23g-mw97-65c8/GHSA-g23g-mw97-65c8.json b/advisories/github-reviewed/2022/11/GHSA-g23g-mw97-65c8/GHSA-g23g-mw97-65c8.json new file mode 100644 index 00000000000..5c777d616c6 --- /dev/null +++ b/advisories/github-reviewed/2022/11/GHSA-g23g-mw97-65c8/GHSA-g23g-mw97-65c8.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g23g-mw97-65c8", + "modified": "2024-04-24T21:00:44Z", + "published": "2022-11-01T19:00:29Z", + "aliases": [ + "CVE-2022-3802" + ], + "summary": "IBAX go-ibax vulnerable to SQL injection", + "details": "SQL Injection vulnerability in `/packages/api/database.go` of go-ibax via `where` parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects versions starting from commits on Jul 18, 2020.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/IBAX-io/go-ibax" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3802" + }, + { + "type": "WEB", + "url": "https://github.com/IBAX-io/go-ibax/issues/2063" + }, + { + "type": "WEB", + "url": "https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/IBAX-io/go-ibax" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.212638" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:00:44Z", + "nvd_published_at": "2022-11-01T16:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-m738-584h-26p6/GHSA-m738-584h-26p6.json b/advisories/github-reviewed/2022/11/GHSA-m738-584h-26p6/GHSA-m738-584h-26p6.json similarity index 59% rename from advisories/unreviewed/2022/11/GHSA-m738-584h-26p6/GHSA-m738-584h-26p6.json rename to advisories/github-reviewed/2022/11/GHSA-m738-584h-26p6/GHSA-m738-584h-26p6.json index 9ea9881c40d..1345155e555 100644 --- a/advisories/unreviewed/2022/11/GHSA-m738-584h-26p6/GHSA-m738-584h-26p6.json +++ b/advisories/github-reviewed/2022/11/GHSA-m738-584h-26p6/GHSA-m738-584h-26p6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-m738-584h-26p6", - "modified": "2022-11-02T19:00:31Z", + "modified": "2024-04-24T21:00:54Z", "published": "2022-11-01T19:00:29Z", "aliases": [ "CVE-2022-3801" ], + "summary": "IBAX go-ibax vulnerable to SQL injection", "details": "A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/IBAX-io/go-ibax" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,14 @@ "type": "WEB", "url": "https://github.com/IBAX-io/go-ibax/issues/2062" }, + { + "type": "WEB", + "url": "https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/IBAX-io/go-ibax" + }, { "type": "WEB", "url": "https://vuldb.com/?id.212637" @@ -32,11 +59,12 @@ ], "database_specific": { "cwe_ids": [ + "CWE-707", "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:00:54Z", "nvd_published_at": "2022-11-01T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-mgqh-3qm7-gx82/GHSA-mgqh-3qm7-gx82.json b/advisories/github-reviewed/2022/11/GHSA-mgqh-3qm7-gx82/GHSA-mgqh-3qm7-gx82.json similarity index 59% rename from advisories/unreviewed/2022/11/GHSA-mgqh-3qm7-gx82/GHSA-mgqh-3qm7-gx82.json rename to advisories/github-reviewed/2022/11/GHSA-mgqh-3qm7-gx82/GHSA-mgqh-3qm7-gx82.json index 8efe402ac07..dfd0a747b7e 100644 --- a/advisories/unreviewed/2022/11/GHSA-mgqh-3qm7-gx82/GHSA-mgqh-3qm7-gx82.json +++ b/advisories/github-reviewed/2022/11/GHSA-mgqh-3qm7-gx82/GHSA-mgqh-3qm7-gx82.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mgqh-3qm7-gx82", - "modified": "2022-11-02T19:00:31Z", + "modified": "2024-04-24T21:01:11Z", "published": "2022-11-01T19:00:29Z", "aliases": [ "CVE-2022-3798" ], + "summary": "IBAX go-ibax vulnerable to SQL injection", "details": "A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/IBAX-io/go-ibax" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,14 @@ "type": "WEB", "url": "https://github.com/IBAX-io/go-ibax/issues/2060" }, + { + "type": "WEB", + "url": "https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/IBAX-io/go-ibax" + }, { "type": "WEB", "url": "https://vuldb.com/?id.212634" @@ -35,8 +62,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:01:10Z", "nvd_published_at": "2022-11-01T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-rwcf-gq22-ph83/GHSA-rwcf-gq22-ph83.json b/advisories/github-reviewed/2022/11/GHSA-rwcf-gq22-ph83/GHSA-rwcf-gq22-ph83.json similarity index 60% rename from advisories/unreviewed/2022/11/GHSA-rwcf-gq22-ph83/GHSA-rwcf-gq22-ph83.json rename to advisories/github-reviewed/2022/11/GHSA-rwcf-gq22-ph83/GHSA-rwcf-gq22-ph83.json index 14fa79e8b84..1962f48b0ec 100644 --- a/advisories/unreviewed/2022/11/GHSA-rwcf-gq22-ph83/GHSA-rwcf-gq22-ph83.json +++ b/advisories/github-reviewed/2022/11/GHSA-rwcf-gq22-ph83/GHSA-rwcf-gq22-ph83.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rwcf-gq22-ph83", - "modified": "2022-11-02T19:00:31Z", + "modified": "2024-04-24T21:01:07Z", "published": "2022-11-01T19:00:29Z", "aliases": [ "CVE-2022-3800" ], + "summary": "IBAX go-ibax vulnerable to SQL injection", "details": "A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/IBAX-io/go-ibax" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,14 @@ "type": "WEB", "url": "https://github.com/IBAX-io/go-ibax/issues/2061" }, + { + "type": "WEB", + "url": "https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/IBAX-io/go-ibax" + }, { "type": "WEB", "url": "https://vuldb.com/?id.212636" @@ -35,8 +62,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:01:07Z", "nvd_published_at": "2022-11-01T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-28g7-896h-695v/GHSA-28g7-896h-695v.json b/advisories/github-reviewed/2024/04/GHSA-28g7-896h-695v/GHSA-28g7-896h-695v.json new file mode 100644 index 00000000000..112925ed60c --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-28g7-896h-695v/GHSA-28g7-896h-695v.json @@ -0,0 +1,112 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-28g7-896h-695v", + "modified": "2024-04-24T21:01:50Z", + "published": "2024-04-24T21:01:50Z", + "aliases": [ + "CVE-2021-36775" + ], + "summary": "Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication", + "details": "### Impact\nThis vulnerability only affects customers using group based authentication in Rancher versions up to and including 2.4.17, 2.5.11 and 2.6.2.\n\nWhen removing a Project Role associated to a group from a project, the bindings that grant access to cluster scoped resources for those subjects do not get deleted. This happens due to an incomplete authorization logic check. A user who is a member of an affected group with authenticated access to Rancher could use this to access resources they should no longer have access to. The exposure level will depend on the original permission level granted to the affected project role.\n\n### Patches\nPatched versions include releases 2.4.18, 2.5.12, 2.6.3 and later versions.\n\n### Workarounds\nLimit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.\n\n### References\nCluster and project roles documentation for Rancher [2.6](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/), [2.5](https://rancher.com/docs/rancher/v2.5/en/admin-settings/rbac/cluster-project-roles/) and [2.4](https://rancher.com/docs/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.18" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.4.17" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.12" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.5.11" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.6.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.6.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rancher/rancher/security/advisories/GHSA-28g7-896h-695v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36775" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=1189120" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rancher/rancher" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:01:50Z", + "nvd_published_at": "2022-04-04T13:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-gvh9-xgrq-r8hw/GHSA-gvh9-xgrq-r8hw.json b/advisories/github-reviewed/2024/04/GHSA-gvh9-xgrq-r8hw/GHSA-gvh9-xgrq-r8hw.json new file mode 100644 index 00000000000..c644e73061c --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-gvh9-xgrq-r8hw/GHSA-gvh9-xgrq-r8hw.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gvh9-xgrq-r8hw", + "modified": "2024-04-24T21:01:53Z", + "published": "2024-04-24T21:01:53Z", + "aliases": [ + "CVE-2021-36776" + ], + "summary": "Rancher's Steve API Component Improper authorization check allows privilege escalation", + "details": "### Impact\n\nA flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user's credentials. This is due to the Steve API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, receiving, then, administrator level access in the cluster.\n\n### Patches\nPatched versions include releases 2.5.10, 2.6.0 and later versions.\n\n### Workarounds\nLimit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.10" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.5.9" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36776" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=1189413" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rancher/rancher" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T21:01:53Z", + "nvd_published_at": "2022-04-04T13:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-g23g-mw97-65c8/GHSA-g23g-mw97-65c8.json b/advisories/unreviewed/2022/11/GHSA-g23g-mw97-65c8/GHSA-g23g-mw97-65c8.json deleted file mode 100644 index 2645d85337c..00000000000 --- a/advisories/unreviewed/2022/11/GHSA-g23g-mw97-65c8/GHSA-g23g-mw97-65c8.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-g23g-mw97-65c8", - "modified": "2022-11-02T19:00:31Z", - "published": "2022-11-01T19:00:29Z", - "aliases": [ - "CVE-2022-3802" - ], - "details": "A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212638 is the identifier assigned to this vulnerability.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3802" - }, - { - "type": "WEB", - "url": "https://github.com/IBAX-io/go-ibax/issues/2063" - }, - { - "type": "WEB", - "url": "https://vuldb.com/?id.212638" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-11-01T16:15:00Z" - } -} \ No newline at end of file