From d818b011e8e6034ea99e68fb6cca06072156e1ea Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 21:00:17 +0000 Subject: [PATCH] Publish Advisories GHSA-4rqq-rxvc-v2rc GHSA-3393-r4p5-vhqh GHSA-hqx2-j33x-9fc4 GHSA-j99q-rwp6-498g GHSA-fhv8-m4j4-cww2 GHSA-hqx2-j33x-9fc4 --- .../GHSA-4rqq-rxvc-v2rc.json | 39 +++++++++- .../GHSA-3393-r4p5-vhqh.json | 42 ++++++++-- .../GHSA-hqx2-j33x-9fc4.json | 77 +++++++++++++++++++ .../GHSA-j99q-rwp6-498g.json | 38 +++++++-- .../GHSA-fhv8-m4j4-cww2.json | 43 +++++++++-- .../GHSA-hqx2-j33x-9fc4.json | 35 --------- 6 files changed, 215 insertions(+), 59 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json (53%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json (51%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json (54%) rename advisories/{unreviewed => github-reviewed}/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json (59%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json diff --git a/advisories/unreviewed/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json b/advisories/github-reviewed/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json similarity index 53% rename from advisories/unreviewed/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json rename to advisories/github-reviewed/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json index 22286ccd767..801905de67e 100644 --- a/advisories/unreviewed/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json +++ b/advisories/github-reviewed/2022/03/GHSA-4rqq-rxvc-v2rc/GHSA-4rqq-rxvc-v2rc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4rqq-rxvc-v2rc", - "modified": "2022-03-30T00:00:41Z", + "modified": "2024-04-24T20:58:20Z", "published": "2022-03-25T00:00:33Z", "aliases": [ "CVE-2022-1058" ], + "summary": "Gitea Open Redirect", "details": "Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.", "severity": [ { @@ -14,17 +15,47 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "code.gitea.io/gitea" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.16.5" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1058" }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/19175" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/19186" + }, { "type": "WEB", "url": "https://github.com/go-gitea/gitea/commit/e3d8e92bdc67562783de9a76b5b7842b68daeb48" }, + { + "type": "PACKAGE", + "url": "https://github.com/go-gitea/gitea" + }, { "type": "WEB", "url": "https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d" @@ -35,8 +66,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:58:20Z", "nvd_published_at": "2022-03-24T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json b/advisories/github-reviewed/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json rename to advisories/github-reviewed/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json index b1e15cab10b..abf240ab480 100644 --- a/advisories/unreviewed/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json +++ b/advisories/github-reviewed/2022/05/GHSA-3393-r4p5-vhqh/GHSA-3393-r4p5-vhqh.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-3393-r4p5-vhqh", - "modified": "2022-05-24T16:44:49Z", + "modified": "2024-04-24T20:58:10Z", "published": "2022-05-24T16:44:49Z", "aliases": [ "CVE-2019-11576" ], + "summary": "Gitea Allows 1FA Even for 2FA-Enrolled Accounts", "details": "Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "code.gitea.io/gitea" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.8.0" + } + ] + } + ] + } ], "references": [ { @@ -22,18 +44,26 @@ "type": "WEB", "url": "https://github.com/go-gitea/gitea/pull/6674" }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/6676" + }, { "type": "WEB", "url": "https://blog.gitea.io/2019/04/gitea-1.8.0-is-released" + }, + { + "type": "PACKAGE", + "url": "https://github.com/go-gitea/gitea" } ], "database_specific": { "cwe_ids": [ - + "CWE-287" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:58:10Z", "nvd_published_at": "2019-04-28T02:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json b/advisories/github-reviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json new file mode 100644 index 00000000000..b234cd07d7f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hqx2-j33x-9fc4", + "modified": "2024-04-24T20:58:00Z", + "published": "2022-05-24T16:50:02Z", + "aliases": [ + "CVE-2019-1010314" + ], + "summary": "Gitea XSS Vulnerability in Repository Description", + "details": "Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "code.gitea.io/gitea" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7.2" + }, + { + "fixed": "1.7.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010314" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/issues/8717" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/6306" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/6308" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/c7bbfd8f5eb097c6910e142415fcdf48fc3c9814" + }, + { + "type": "PACKAGE", + "url": "https://github.com/go-gitea/gitea" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.7.4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:58:00Z", + "nvd_published_at": "2019-07-11T20:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json b/advisories/github-reviewed/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json rename to advisories/github-reviewed/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json index 8fa5d0088b5..7fc48963cb0 100644 --- a/advisories/unreviewed/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json +++ b/advisories/github-reviewed/2022/05/GHSA-j99q-rwp6-498g/GHSA-j99q-rwp6-498g.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-j99q-rwp6-498g", - "modified": "2022-05-13T01:21:42Z", + "modified": "2024-04-24T20:58:26Z", "published": "2022-05-13T01:21:42Z", "aliases": [ "CVE-2019-1000002" ], - "details": "Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to \"any\" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.", + "summary": "Gitea Arbitrary File Delete Vulnerability", + "details": "Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to \"any\" repository including self-created ones. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "code.gitea.io/gitea" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.6.2" + } + } ], "references": [ { @@ -24,15 +46,19 @@ { "type": "WEB", "url": "https://github.com/go-gitea/gitea/pull/5631" + }, + { + "type": "PACKAGE", + "url": "https://github.com/go-gitea/gitea" } ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:58:26Z", "nvd_published_at": "2019-02-04T21:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json b/advisories/github-reviewed/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json similarity index 59% rename from advisories/unreviewed/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json rename to advisories/github-reviewed/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json index 6d9a3d83037..0684b4779ea 100644 --- a/advisories/unreviewed/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json +++ b/advisories/github-reviewed/2022/08/GHSA-fhv8-m4j4-cww2/GHSA-fhv8-m4j4-cww2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fhv8-m4j4-cww2", - "modified": "2022-08-17T00:00:23Z", + "modified": "2024-04-24T20:58:17Z", "published": "2022-08-13T00:00:25Z", "aliases": [ "CVE-2022-38183" ], + "summary": "Gitea allowed assignment of private issues", "details": "In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.", "severity": [ { @@ -14,24 +15,50 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "code.gitea.io/gitea" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.16.9" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38183" }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/20133" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/20196" + }, { "type": "WEB", "url": "https://blog.gitea.io/2022/07/gitea-1.16.9-is-released" }, + { + "type": "PACKAGE", + "url": "https://github.com/go-gitea/gitea" + }, { "type": "WEB", "url": "https://herolab.usd.de/security-advisories/usd-2022-0015" - }, - { - "type": "WEB", - "url": "https://security.gentoo.org/glsa/202210-14" } ], "database_specific": { @@ -39,8 +66,8 @@ "CWE-732" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:58:17Z", "nvd_published_at": "2022-08-12T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json b/advisories/unreviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json deleted file mode 100644 index 12ded7a85a5..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-hqx2-j33x-9fc4/GHSA-hqx2-j33x-9fc4.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hqx2-j33x-9fc4", - "modified": "2022-05-24T16:50:02Z", - "published": "2022-05-24T16:50:02Z", - "aliases": [ - "CVE-2019-1010314" - ], - "details": "Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010314" - }, - { - "type": "WEB", - "url": "https://github.com/go-gitea/gitea/releases" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-07-11T20:15:00Z" - } -} \ No newline at end of file