netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-h658-qqv9-qwv8
GHSA-phg7-8mm9-gj88
GHSA-h658-qqv9-qwv8
This commit is contained in:
advisory-database[bot]
2024-07-08 15:01:19 +00:00
parent e2b1331c2b
commit cb3155f90c
3 changed files with 133 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/07/GHSA-h658-qqv9-qwv8/GHSA-h658-qqv9-qwv8.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h658-qqv9-qwv8",
"modified": "2024-07-08T14:59:49Z",
"published": "2024-07-08T09:32:22Z",
"aliases": [
"CVE-2024-37389"
],
"summary": "Apache NiFi vulnerable to Cross-site Scripting",
"details": "Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi-web-ui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.27.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi-web-ui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0-M1"
},
{
"fixed": "2.0.0-M4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37389"
},
{
"type": "WEB",
"url": "https://github.com/apache/nifi/pull/8938"
},
{
"type": "WEB",
"url": "https://github.com/apache/nifi/commit/1ea0bc1f7fa90ecff0ceb8b0c91a9aebeb05893b"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/nifi"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/NIFI-13374"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-07-08T14:59:48Z",
"nvd_published_at": "2024-07-08T08:15:10Z"
}
}
advisories/unreviewed/2024/07/GHSA-phg7-8mm9-gj88/GHSA-phg7-8mm9-gj88.json → advisories/github-reviewed/2024/07/GHSA-phg7-8mm9-gj88/GHSA-phg7-8mm9-gj88.json
+37 -7
View File
@@ -1,17 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-phg7-8mm9-gj88",
"modified": "2024-07-07T15:31:12Z",
"modified": "2024-07-08T15:00:36Z",
"published": "2024-07-07T15:31:12Z",
"aliases": [
"CVE-2024-40614"
],
"summary": "EGroupware mishandles an ORDER BY clause",
"details": "EGroupware before 23.1.20240624 mishandles an ORDER BY clause.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "egroupware/egroupware"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "23.1.20240624"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +48,10 @@
"type": "WEB",
"url": "https://github.com/EGroupware/egroupware/commit/553829d30cc2ccdc0e5a8c5a0e16fa03a3399a3f"
},
{
"type": "PACKAGE",
"url": "https://github.com/EGroupware/egroupware"
},
{
"type": "WEB",
"url": "https://github.com/EGroupware/egroupware/compare/23.1.20240430...23.1.20240624"
@@ -41,11 +71,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-07-08T15:00:36Z",
"nvd_published_at": "2024-07-07T15:15:09Z"
}
}
advisories/unreviewed/2024/07/GHSA-h658-qqv9-qwv8/GHSA-h658-qqv9-qwv8.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h658-qqv9-qwv8",
"modified": "2024-07-08T09:32:22Z",
"published": "2024-07-08T09:32:22Z",
"aliases": [
"CVE-2024-37389"
],
"details": "Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37389"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-08T08:15:10Z"
}
}