diff --git a/advisories/unreviewed/2024/03/GHSA-389c-cf87-qmwj/GHSA-389c-cf87-qmwj.json b/advisories/github-reviewed/2024/03/GHSA-389c-cf87-qmwj/GHSA-389c-cf87-qmwj.json similarity index 68% rename from advisories/unreviewed/2024/03/GHSA-389c-cf87-qmwj/GHSA-389c-cf87-qmwj.json rename to advisories/github-reviewed/2024/03/GHSA-389c-cf87-qmwj/GHSA-389c-cf87-qmwj.json index 9faa7d9c1a5..bbe37ad33cd 100644 --- a/advisories/unreviewed/2024/03/GHSA-389c-cf87-qmwj/GHSA-389c-cf87-qmwj.json +++ b/advisories/github-reviewed/2024/03/GHSA-389c-cf87-qmwj/GHSA-389c-cf87-qmwj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-389c-cf87-qmwj", - "modified": "2024-03-19T06:30:53Z", + "modified": "2024-03-20T15:25:07Z", "published": "2024-03-19T06:30:53Z", "aliases": [ "CVE-2024-21504" ], + "summary": "Cross-site Scripting in livewire/livewire", "details": "Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "livewire/livewire" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3.5" + }, + { + "fixed": "3.4.9" + } + ] + } + ] + } ], "references": [ { @@ -29,6 +48,10 @@ "type": "WEB", "url": "https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0" }, + { + "type": "PACKAGE", + "url": "https://github.com/livewire/livewire" + }, { "type": "WEB", "url": "https://github.com/livewire/livewire/releases/tag/v3.4.9" @@ -43,8 +66,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-03-20T15:25:06Z", "nvd_published_at": "2024-03-19T05:15:09Z" } } \ No newline at end of file