From db41310983263e291af8c05c19ca47a9498ef97e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 18 Nov 2024 23:47:04 +0000 Subject: [PATCH] Publish Advisories GHSA-vxmc-5x29-h64v GHSA-cq5f-wv7p-5gfc GHSA-fjq9-452g-jg3q GHSA-x3x9-349x-2485 GHSA-cq5f-wv7p-5gfc GHSA-fjq9-452g-jg3q GHSA-x3x9-349x-2485 --- .../GHSA-vxmc-5x29-h64v.json | 31 ++++- .../GHSA-cq5f-wv7p-5gfc.json | 118 ++++++++++++++++++ .../GHSA-fjq9-452g-jg3q.json | 118 ++++++++++++++++++ .../GHSA-x3x9-349x-2485.json | 118 ++++++++++++++++++ .../GHSA-cq5f-wv7p-5gfc.json | 38 ------ .../GHSA-fjq9-452g-jg3q.json | 38 ------ .../GHSA-x3x9-349x-2485.json | 35 ------ 7 files changed, 381 insertions(+), 115 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json (62%) create mode 100644 advisories/github-reviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json delete mode 100644 advisories/unreviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json delete mode 100644 advisories/unreviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json delete mode 100644 advisories/unreviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json diff --git a/advisories/unreviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json b/advisories/github-reviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json similarity index 62% rename from advisories/unreviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json rename to advisories/github-reviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json index 198f3451acf..7e0b4044325 100644 --- a/advisories/unreviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json +++ b/advisories/github-reviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vxmc-5x29-h64v", - "modified": "2024-07-11T18:31:14Z", + "modified": "2024-11-18T23:46:00Z", "published": "2024-07-11T18:31:14Z", "aliases": [ "CVE-2024-6485" ], + "summary": "Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes", "details": "A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "bootstrap" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.4.0" + }, + { + "fixed": "3.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6485" }, + { + "type": "PACKAGE", + "url": "https://github.com/twbs/bootstrap" + }, { "type": "WEB", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6485" @@ -31,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T23:46:00Z", "nvd_published_at": "2024-07-11T17:15:17Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json b/advisories/github-reviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json new file mode 100644 index 00000000000..91e764a20c8 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cq5f-wv7p-5gfc", + "modified": "2024-11-18T23:46:21Z", + "published": "2024-11-18T12:30:43Z", + "aliases": [ + "CVE-2024-48896" + ], + "summary": "Moodle leaks user names", + "details": "A vulnerability was found in Moodle. It is possible for users with the \"send message\" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48896" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318822" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T23:46:20Z", + "nvd_published_at": "2024-11-18T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json b/advisories/github-reviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json new file mode 100644 index 00000000000..fead18b37dc --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fjq9-452g-jg3q", + "modified": "2024-11-18T23:46:44Z", + "published": "2024-11-18T12:30:43Z", + "aliases": [ + "CVE-2024-48898" + ], + "summary": "moodle: Some users can delete audiences of other reports", + "details": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48898" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T23:46:44Z", + "nvd_published_at": "2024-11-18T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json b/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json new file mode 100644 index 00000000000..daf99fcf001 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3x9-349x-2485", + "modified": "2024-11-18T23:46:24Z", + "published": "2024-11-18T12:30:43Z", + "aliases": [ + "CVE-2024-48897" + ], + "summary": "moodle: IDOR in edit/delete RSS feed", + "details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48897" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318821" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T23:46:24Z", + "nvd_published_at": "2024-11-18T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json b/advisories/unreviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json deleted file mode 100644 index 10af9931db9..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-cq5f-wv7p-5gfc", - "modified": "2024-11-18T18:30:55Z", - "published": "2024-11-18T12:30:43Z", - "aliases": [ - "CVE-2024-48896" - ], - "details": "A vulnerability was found in Moodle. It is possible for users with the \"send message\" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48896" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318822" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-209" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-18T12:15:18Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json b/advisories/unreviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json deleted file mode 100644 index 85d325b18b4..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fjq9-452g-jg3q", - "modified": "2024-11-18T18:30:55Z", - "published": "2024-11-18T12:30:43Z", - "aliases": [ - "CVE-2024-48898" - ], - "details": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48898" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-862" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-18T12:15:18Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json b/advisories/unreviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json deleted file mode 100644 index 8265ab288ab..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x3x9-349x-2485", - "modified": "2024-11-18T12:30:43Z", - "published": "2024-11-18T12:30:43Z", - "aliases": [ - "CVE-2024-48897" - ], - "details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48897" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318821" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-285" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-18T12:15:18Z" - } -} \ No newline at end of file