From d467483c3743525cc43b0c8cee95838d1ad6171a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 3 Apr 2025 16:18:20 +0000 Subject: [PATCH] Publish Advisories GHSA-m8w6-7rh6-4xj6 GHSA-r6cf-cr44-m8rr --- .../GHSA-m8w6-7rh6-4xj6.json | 52 +++++++++++++++---- .../GHSA-r6cf-cr44-m8rr.json | 52 +++++++++++++++---- 2 files changed, 84 insertions(+), 20 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json (68%) rename advisories/{unreviewed => github-reviewed}/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json (69%) diff --git a/advisories/unreviewed/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json b/advisories/github-reviewed/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json similarity index 68% rename from advisories/unreviewed/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json rename to advisories/github-reviewed/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json index 5ac0c799148..c94571cd685 100644 --- a/advisories/unreviewed/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json +++ b/advisories/github-reviewed/2022/04/GHSA-m8w6-7rh6-4xj6/GHSA-m8w6-7rh6-4xj6.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-m8w6-7rh6-4xj6", - "modified": "2025-04-03T03:50:58Z", + "modified": "2025-04-03T16:15:42Z", "published": "2022-04-30T18:22:20Z", "aliases": [ "CVE-2002-2008" ], + "summary": "Apache Tomcat Leaks Information via Error Message", "details": "Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-2008" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/tomcat" + }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E" @@ -38,6 +68,10 @@ "type": "WEB", "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E" }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200815000000*/http://www.securityfocus.com/bid/5054" + }, { "type": "WEB", "url": "http://archives.neohapsis.com/archives/bugtraq/2002-06/0225.html" @@ -49,17 +83,15 @@ { "type": "WEB", "url": "http://www.iss.net/security_center/static/9394.php" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/5054" } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-209" + ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-03T16:15:42Z", "nvd_published_at": "2002-12-31T05:00:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json b/advisories/github-reviewed/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json similarity index 69% rename from advisories/unreviewed/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json rename to advisories/github-reviewed/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json index 2a8d35d2992..cf53fe3f806 100644 --- a/advisories/unreviewed/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json +++ b/advisories/github-reviewed/2022/04/GHSA-r6cf-cr44-m8rr/GHSA-r6cf-cr44-m8rr.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-r6cf-cr44-m8rr", - "modified": "2025-04-03T03:50:59Z", + "modified": "2025-04-03T16:15:46Z", "published": "2022-04-30T18:22:19Z", "aliases": [ "CVE-2002-2009" ], + "summary": "Apache Tomcat Leaks Pathname Information via Error Message", "details": "Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3)