From c7600fb7a06889878c21ca57bb4d98aaed84099e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 20:36:04 +0000 Subject: [PATCH] Publish Advisories GHSA-8r2w-phx4-mgpv GHSA-8v7v-6mmm-xjxm GHSA-f848-r5g6-6gpf GHSA-fvf9-2hjp-w936 GHSA-m396-2x3h-v3v4 GHSA-q938-82fw-wfcf GHSA-8v7v-6mmm-xjxm GHSA-m396-2x3h-v3v4 --- .../GHSA-8r2w-phx4-mgpv.json | 33 ++++++++-- .../GHSA-8v7v-6mmm-xjxm.json | 61 +++++++++++++++++++ .../GHSA-f848-r5g6-6gpf.json | 24 ++++++-- .../GHSA-fvf9-2hjp-w936.json | 23 +++++-- .../GHSA-m396-2x3h-v3v4.json | 61 +++++++++++++++++++ .../GHSA-q938-82fw-wfcf.json | 23 +++++-- .../GHSA-8v7v-6mmm-xjxm.json | 35 ----------- .../GHSA-m396-2x3h-v3v4.json | 38 ------------ 8 files changed, 205 insertions(+), 93 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json (62%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json (66%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json (64%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json (64%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json diff --git a/advisories/unreviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json b/advisories/github-reviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json rename to advisories/github-reviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json index 1fd2105da75..4932bb71f24 100644 --- a/advisories/unreviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json +++ b/advisories/github-reviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8r2w-phx4-mgpv", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:34:41Z", "published": "2022-05-24T17:26:59Z", "aliases": [ "CVE-2020-13828" ], + "summary": "Dolibarr stored Cross-Site Scripting (XSS) vulnerability", "details": "Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with the alias or barcode parameter.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "11.0.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13828" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-002" @@ -30,9 +53,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:34:41Z", "nvd_published_at": "2020-08-31T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json b/advisories/github-reviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json new file mode 100644 index 00000000000..644fdfc1e95 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8v7v-6mmm-xjxm", + "modified": "2024-04-24T20:35:18Z", + "published": "2022-05-24T17:20:55Z", + "aliases": [ + "CVE-2020-14443" + ], + "summary": "Dolibarr SQL injection vulnerability in accountancy/customer/card.php", + "details": "A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.4 and below allows remote authenticated users to execute arbitrary SQL commands via the id parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14443" + }, + { + "type": "WEB", + "url": "https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:35:18Z", + "nvd_published_at": "2020-06-18T18:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json b/advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json rename to advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json index b573f7a78a8..26a33442bce 100644 --- a/advisories/unreviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json +++ b/advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-f848-r5g6-6gpf", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:35:34Z", "published": "2022-05-24T17:18:11Z", "aliases": [ "CVE-2020-13240" ], + "summary": "Dolibarr Stored Cross-site Scripting", "details": "The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "11.0.4" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13240" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.dubget.com/stored-xss-via-file-upload.html" @@ -29,11 +42,12 @@ "database_specific": { "cwe_ids": [ "CWE-276", - "CWE-668" + "CWE-668", + "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:35:34Z", "nvd_published_at": "2020-05-20T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json b/advisories/github-reviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json rename to advisories/github-reviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json index 779ab0a680b..c6831284405 100644 --- a/advisories/unreviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json +++ b/advisories/github-reviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fvf9-2hjp-w936", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:35:29Z", "published": "2022-05-24T17:18:12Z", "aliases": [ "CVE-2020-13239" ], + "summary": "Dolibarr Stored Cross-site Scripting via file upload", "details": "The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "11.0.4" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13239" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.dubget.com/stored-xss-via-file-upload.html" @@ -30,9 +43,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:35:29Z", "nvd_published_at": "2020-05-20T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json b/advisories/github-reviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json new file mode 100644 index 00000000000..208275e2d7a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m396-2x3h-v3v4", + "modified": "2024-04-24T20:35:00Z", + "published": "2022-05-24T17:21:18Z", + "aliases": [ + "CVE-2020-14475" + ], + "summary": "Dolibarr reflected cross-site scripting (XSS) vulnerability", + "details": "A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.4 and below allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14475" + }, + { + "type": "WEB", + "url": "https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:35:00Z", + "nvd_published_at": "2020-06-19T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json b/advisories/github-reviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json rename to advisories/github-reviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json index dd7bf41e485..b40e07ae46e 100644 --- a/advisories/unreviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json +++ b/advisories/github-reviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-q938-82fw-wfcf", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:35:39Z", "published": "2022-05-24T17:15:34Z", "aliases": [ "CVE-2020-11823" ], + "summary": "Dolibarr stored Cross-site Scripting vulnerability", "details": "In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.", "severity": [ { @@ -14,7 +15,15 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "10.0.6" + ] + } ], "references": [ { @@ -24,15 +33,19 @@ { "type": "WEB", "url": "https://fatihhcelik.blogspot.com/2020/04/dolibarr-stored-xss.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:35:39Z", "nvd_published_at": "2020-04-16T19:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json b/advisories/unreviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json deleted file mode 100644 index 996fd2456df..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8v7v-6mmm-xjxm", - "modified": "2022-05-24T17:20:55Z", - "published": "2022-05-24T17:20:55Z", - "aliases": [ - "CVE-2020-14443" - ], - "details": "A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14443" - }, - { - "type": "WEB", - "url": "https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-06-18T18:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json b/advisories/unreviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json deleted file mode 100644 index 7954bc9f561..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m396-2x3h-v3v4", - "modified": "2022-11-17T18:30:30Z", - "published": "2022-05-24T17:21:18Z", - "aliases": [ - "CVE-2020-14475" - ], - "details": "A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14475" - }, - { - "type": "WEB", - "url": "https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-06-19T17:15:00Z" - } -} \ No newline at end of file