diff --git a/advisories/github-reviewed/2022/05/GHSA-78vx-ggch-wghm/GHSA-78vx-ggch-wghm.json b/advisories/github-reviewed/2022/05/GHSA-78vx-ggch-wghm/GHSA-78vx-ggch-wghm.json index b9c744362e4..5d6dd16a382 100644 --- a/advisories/github-reviewed/2022/05/GHSA-78vx-ggch-wghm/GHSA-78vx-ggch-wghm.json +++ b/advisories/github-reviewed/2022/05/GHSA-78vx-ggch-wghm/GHSA-78vx-ggch-wghm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-78vx-ggch-wghm", - "modified": "2023-08-29T21:47:28Z", + "modified": "2024-09-16T22:14:25Z", "published": "2022-05-17T05:12:01Z", "aliases": [ "CVE-2012-3442" @@ -9,13 +9,20 @@ "summary": "Django Allows Redirect via Data URL", "details": "The (1) `django.http.HttpResponseRedirect` and (2) `django.http.HttpResponsePermanentRedirect` classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a `data:` URL.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -34,7 +41,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -68,6 +75,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2012-2.yaml" + }, { "type": "WEB", "url": "https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued" @@ -76,6 +87,10 @@ "type": "WEB", "url": "http://www.debian.org/security/2012/dsa-2529" }, + { + "type": "WEB", + "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:143" + }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2012/07/31/1" diff --git a/advisories/github-reviewed/2022/05/GHSA-rvq6-mrpv-m6rm/GHSA-rvq6-mrpv-m6rm.json b/advisories/github-reviewed/2022/05/GHSA-rvq6-mrpv-m6rm/GHSA-rvq6-mrpv-m6rm.json index 99642db654c..9009ea42e3b 100644 --- a/advisories/github-reviewed/2022/05/GHSA-rvq6-mrpv-m6rm/GHSA-rvq6-mrpv-m6rm.json +++ b/advisories/github-reviewed/2022/05/GHSA-rvq6-mrpv-m6rm/GHSA-rvq6-mrpv-m6rm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rvq6-mrpv-m6rm", - "modified": "2024-05-16T18:28:00Z", + "modified": "2024-09-16T22:13:37Z", "published": "2022-05-17T03:07:04Z", "aliases": [ "CVE-2014-0472" @@ -9,7 +9,14 @@ "summary": "Code Injection in Django", "details": "The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a \"dotted Python path.\"", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -51,7 +58,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "1.5.0" + "introduced": "1.5" }, { "fixed": "1.5.6" @@ -75,7 +82,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "1.6.0" + "introduced": "1.6" }, { "fixed": "1.6.3" @@ -106,6 +113,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-1.yaml" + }, { "type": "WEB", "url": "https://www.djangoproject.com/weblog/2014/apr/21/security" @@ -122,10 +133,6 @@ "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2014-0457.html" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/61281" - }, { "type": "WEB", "url": "http://www.debian.org/security/2014/dsa-2934" @@ -139,7 +146,7 @@ "cwe_ids": [ "CWE-94" ], - "severity": "MODERATE", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2023-02-23T23:29:51Z", "nvd_published_at": "2014-04-23T15:55:00Z"