diff --git a/advisories/unreviewed/2024/02/GHSA-gcgj-qh8p-57hm/GHSA-gcgj-qh8p-57hm.json b/advisories/github-reviewed/2024/02/GHSA-gcgj-qh8p-57hm/GHSA-gcgj-qh8p-57hm.json similarity index 55% rename from advisories/unreviewed/2024/02/GHSA-gcgj-qh8p-57hm/GHSA-gcgj-qh8p-57hm.json rename to advisories/github-reviewed/2024/02/GHSA-gcgj-qh8p-57hm/GHSA-gcgj-qh8p-57hm.json index 6201304983a..d9de6d9b1c5 100644 --- a/advisories/unreviewed/2024/02/GHSA-gcgj-qh8p-57hm/GHSA-gcgj-qh8p-57hm.json +++ b/advisories/github-reviewed/2024/02/GHSA-gcgj-qh8p-57hm/GHSA-gcgj-qh8p-57hm.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gcgj-qh8p-57hm", - "modified": "2024-02-15T18:30:40Z", + "modified": "2024-02-16T23:20:54Z", "published": "2024-02-09T00:31:35Z", "aliases": [ "CVE-2023-25365" ], + "summary": "October CMS Cross-site Scripting vulnerability", "details": "Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "october/october" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.2.0" + } + ] + } + ] + } ], "references": [ { @@ -24,15 +43,20 @@ { "type": "WEB", "url": "https://cupc4k3.medium.com/cve-2023-25365-xss-via-file-upload-bypass-ddf4d2a106a7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/octobercms/october" } ], "database_specific": { "cwe_ids": [ - "CWE-434" + "CWE-434", + "CWE-79" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-16T23:20:54Z", "nvd_published_at": "2024-02-08T22:15:08Z" } } \ No newline at end of file