From cdc71be5e9c142c9b4f11e9eeae21f076fc47ac5 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 2 Oct 2024 19:31:02 +0000 Subject: [PATCH] Publish Advisories GHSA-4xqv-47rm-37mm GHSA-8jxr-mccc-mwg8 GHSA-vfj8-5pj7-2f9g --- .../GHSA-4xqv-47rm-37mm.json | 85 +++++++++++++++++++ .../GHSA-8jxr-mccc-mwg8.json | 65 ++++++++++++++ .../GHSA-vfj8-5pj7-2f9g.json | 84 ++++++++++++++++++ 3 files changed, 234 insertions(+) create mode 100644 advisories/github-reviewed/2024/10/GHSA-4xqv-47rm-37mm/GHSA-4xqv-47rm-37mm.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-vfj8-5pj7-2f9g/GHSA-vfj8-5pj7-2f9g.json diff --git a/advisories/github-reviewed/2024/10/GHSA-4xqv-47rm-37mm/GHSA-4xqv-47rm-37mm.json b/advisories/github-reviewed/2024/10/GHSA-4xqv-47rm-37mm/GHSA-4xqv-47rm-37mm.json new file mode 100644 index 00000000000..0f1963bfea7 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-4xqv-47rm-37mm/GHSA-4xqv-47rm-37mm.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xqv-47rm-37mm", + "modified": "2024-10-02T19:30:03Z", + "published": "2024-10-02T19:29:35Z", + "aliases": [ + "CVE-2024-47529" + ], + "summary": "OpenC3 stores passwords in clear text (`GHSL-2024-129`)", + "details": "### Summary\nOpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).\n\nNote: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition\n\n### Impact\nThis issue may lead to Information Disclosure.\n\n**NOTE:** The complete advisory with much more information is added as [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm#advisory-comment-104905).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "openc3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@openc3/tool-common" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm" + }, + { + "type": "WEB", + "url": "https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OpenC3/cosmos" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-312", + "CWE-522" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-02T19:29:35Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json b/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json new file mode 100644 index 00000000000..e12c2c182ee --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8jxr-mccc-mwg8", + "modified": "2024-10-02T19:29:32Z", + "published": "2024-10-02T19:29:32Z", + "aliases": [ + "CVE-2024-46977" + ], + "summary": "OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)", + "details": "### Summary\nA path traversal vulnerability inside of `LocalMode`'s `open_local_file` method allows an authenticated user with adequate permissions to download any `.txt` via the `ScreensController#show` on the web server COSMOS is running on (depending on the file permissions).\n\nNote: This CVE affects all OpenC3 COSMOS Editions\n\n### Impact\nThis issue may lead to Information Disclosure.\n\n**NOTE:** The complete advisory with much more information is added as [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8#advisory-comment-104903).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "openc3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8" + }, + { + "type": "WEB", + "url": "https://github.com/OpenC3/cosmos/commit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OpenC3/cosmos" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-02T19:29:32Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-vfj8-5pj7-2f9g/GHSA-vfj8-5pj7-2f9g.json b/advisories/github-reviewed/2024/10/GHSA-vfj8-5pj7-2f9g/GHSA-vfj8-5pj7-2f9g.json new file mode 100644 index 00000000000..de238e8c041 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-vfj8-5pj7-2f9g/GHSA-vfj8-5pj7-2f9g.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vfj8-5pj7-2f9g", + "modified": "2024-10-02T19:29:23Z", + "published": "2024-10-02T19:29:23Z", + "aliases": [ + "CVE-2024-43795" + ], + "summary": "OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)", + "details": "### Summary\nThe login functionality contains a reflected cross-site scripting (XSS) vulnerability.\n\nNote: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition\n\n### Impact\nThis issue may lead up to Remote Code Execution (RCE).\n\n**NOTE:** The complete advisory with much more information is added as [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g#advisory-comment-104904).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "openc3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@openc3/tool-common" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g" + }, + { + "type": "WEB", + "url": "https://github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OpenC3/cosmos" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-02T19:29:23Z", + "nvd_published_at": null + } +} \ No newline at end of file