From dee8e2bc5016f119bc9956572e88557c26d18b80 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 7 Oct 2024 14:56:21 +0000 Subject: [PATCH] Publish Advisories GHSA-52q8-877j-gghq GHSA-c6cw-g7fc-4gwc --- .../GHSA-52q8-877j-gghq.json | 30 ++++-- .../GHSA-c6cw-g7fc-4gwc.json | 94 +++++++++++++++++++ 2 files changed, 114 insertions(+), 10 deletions(-) create mode 100644 advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json diff --git a/advisories/github-reviewed/2020/11/GHSA-52q8-877j-gghq/GHSA-52q8-877j-gghq.json b/advisories/github-reviewed/2020/11/GHSA-52q8-877j-gghq/GHSA-52q8-877j-gghq.json index c91cead2b34..906786eb04e 100644 --- a/advisories/github-reviewed/2020/11/GHSA-52q8-877j-gghq/GHSA-52q8-877j-gghq.json +++ b/advisories/github-reviewed/2020/11/GHSA-52q8-877j-gghq/GHSA-52q8-877j-gghq.json @@ -1,15 +1,22 @@ { "schema_version": "1.4.0", "id": "GHSA-52q8-877j-gghq", - "modified": "2020-11-11T15:51:56Z", + "modified": "2024-10-07T14:54:33Z", "published": "2020-11-11T15:54:51Z", "aliases": [ "CVE-2020-25074" ], - "summary": "remote code execution via cache action in MoinMoin", - "details": "### Impact\nThe cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to\nthe wiki can use this to achieve remote code execution.\n\n### Patches\nUsers are strongly advised to upgrade to a patched version.\n\nMoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.\n\n### Workarounds\nIt is not advised to work around this, but to upgrade MoinMoin to a patched version.\n\nThat said, a work around via disabling the `cache` or the `AttachFile` action might be possible.\n\nAlso, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.\n\n### Credits\n\nThis vulnerability was discovered by Michael Chapman.\n\n### For more information\nIf you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).", + "summary": "MoinMoin vulnerable to remote code execution via cache action", + "details": "### Impact\nThe cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.\n\n### Patches\nUsers are strongly advised to upgrade to a patched version.\n\nMoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.\n\n### Workarounds\nIt is not advised to work around this, but to upgrade MoinMoin to a patched version.\n\nThat said, a work around via disabling the `cache` or the `AttachFile` action might be possible.\n\nAlso, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.\n\n### Credits\n\nThis vulnerability was discovered by Michael Chapman.\n\n### For more information\nIf you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -17,11 +24,6 @@ "ecosystem": "PyPI", "name": "moin" }, - "ecosystem_specific": { - "affected_functions": [ - "moin.action.cache.execute" - ] - }, "ranges": [ { "type": "ECOSYSTEM", @@ -50,6 +52,14 @@ "type": "WEB", "url": "https://github.com/moinwiki/moin-1.9/commit/6b96a9060069302996b5af47fd4a388fc80172b7" }, + { + "type": "PACKAGE", + "url": "https://github.com/moinwiki/moin" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2020-67.yaml" + }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html" @@ -71,7 +81,7 @@ "cwe_ids": [ "CWE-22" ], - "severity": "CRITICAL", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-11-11T15:51:56Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json b/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json new file mode 100644 index 00000000000..5296ec63053 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json @@ -0,0 +1,94 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c6cw-g7fc-4gwc", + "modified": "2024-10-07T14:55:30Z", + "published": "2024-10-07T14:55:30Z", + "aliases": [ + + ], + "summary": "Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS", + "details": "# Summary\nIf values passed to a paragraph widget are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a paragraph widget is rendered.\n\nVersions of dynamic dashboard from v3.0.0 through v3.0.2 are affected.\n\nPlease upgrade to dynamic dashboard [v3.0.2](https://github.com/lara-zeus/dynamic-dashboard/releases/tag/v3.0.2).\n\n# PoC\n>PoC will be published in a few weeks, once developers have had a chance to upgrade their apps.\n\n# Response\nThis vulnerability (in paragraph widget only) was reported by **Raghav Sharma**, who reported the issue and patched the issue during the morning of 05/10/2024. Thank you **Raghav Sharma**.\n\nThe review process concluded the same day at night, which revealed the issue was also present in paragraph widget. This was fixed the same day and dynamic dashboard [v3.0.2](https://github.com/lara-zeus/dynamic-dashboard/releases/tag/v3.0.2) followed.\n\n## Note:\nif you're published the view (blade files), you have to republish them or check the changes on release to update the affected file.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "lara-zeus/dynamic-dashboard" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.0.1" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "lara-zeus/artemis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.0.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.6" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lara-zeus/dynamic-dashboard/security/advisories/GHSA-c6cw-g7fc-4gwc" + }, + { + "type": "WEB", + "url": "https://github.com/lara-zeus/artemis/commit/4636f58628d20d3e78ea8514406bd7da94997f2c" + }, + { + "type": "WEB", + "url": "https://github.com/lara-zeus/dynamic-dashboard/commit/adfb4b1cdfdaa01299631f0e569ce201a7cc545a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lara-zeus/dynamic-dashboard" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-07T14:55:30Z", + "nvd_published_at": null + } +} \ No newline at end of file