diff --git a/advisories/github-reviewed/2024/09/GHSA-62r2-gcxr-426x/GHSA-62r2-gcxr-426x.json b/advisories/github-reviewed/2024/09/GHSA-62r2-gcxr-426x/GHSA-62r2-gcxr-426x.json new file mode 100644 index 00000000000..a5e44b8787f --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-62r2-gcxr-426x/GHSA-62r2-gcxr-426x.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-62r2-gcxr-426x", + "modified": "2024-09-30T17:48:33Z", + "published": "2024-09-30T17:48:33Z", + "aliases": [ + "CVE-2024-47536" + ], + "summary": " starcitizentools/citizen-skin vulnerable to stored, self-XSS in the \"real name\" field", + "details": "### Summary\nA user with the `editmyprivateinfo` right or who can otherwise change their name can XSS themselves by setting their \"real name\" to an XSS payload.\n\n### Details\nHere's the offending line:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137\n\nThis was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c\n\n### PoC\n1. Login\n2. Go to Special:Preferences\n3. Set the real name field to a string like ``\n4. Save your settings and use Citizen if it's not being used already\n\n![](https://github.com/user-attachments/assets/22adbb70-fcd7-4f81-8e53-1f5f3a730270)\n\n### Impact\nAny user who can change their name (whether it's through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "starcitizentools/citizen-skin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.3" + }, + { + "fixed": "2.31.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-62r2-gcxr-426x" + }, + { + "type": "WEB", + "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/717d16af35b10dab04d434aefddbf991fc8c168c" + }, + { + "type": "WEB", + "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/86da3e07718c8d8da6f4310386fef85599606f9b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen" + }, + { + "type": "WEB", + "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79", + "CWE-80" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-30T17:48:33Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-7p89-p6hx-q4fw/GHSA-7p89-p6hx-q4fw.json b/advisories/github-reviewed/2024/09/GHSA-7p89-p6hx-q4fw/GHSA-7p89-p6hx-q4fw.json new file mode 100644 index 00000000000..89c758e5ab9 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-7p89-p6hx-q4fw/GHSA-7p89-p6hx-q4fw.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7p89-p6hx-q4fw", + "modified": "2024-09-30T17:48:29Z", + "published": "2024-09-30T17:48:29Z", + "aliases": [ + "CVE-2024-47178" + ], + "summary": "basic-auth-connect's callback uses time unsafe string comparison", + "details": "### Impact\n\nbasic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information\n\n### Patches\n\nthis issue has been fixed in basic-auth-connect 1.1.0\n\n### References\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "basic-auth-connect" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/expressjs/basic-auth-connect/security/advisories/GHSA-7p89-p6hx-q4fw" + }, + { + "type": "WEB", + "url": "https://github.com/expressjs/basic-auth-connect/commit/bac1e6a8530e1efd0028800b9b588a37adb0d203" + }, + { + "type": "PACKAGE", + "url": "https://github.com/expressjs/basic-auth-connect" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-208" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-30T17:48:29Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-h5q3-fjp4-2x7r/GHSA-h5q3-fjp4-2x7r.json b/advisories/github-reviewed/2024/09/GHSA-h5q3-fjp4-2x7r/GHSA-h5q3-fjp4-2x7r.json new file mode 100644 index 00000000000..4303b6ff544 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-h5q3-fjp4-2x7r/GHSA-h5q3-fjp4-2x7r.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h5q3-fjp4-2x7r", + "modified": "2024-09-30T17:48:15Z", + "published": "2024-09-30T17:48:15Z", + "aliases": [ + "CVE-2024-45792" + ], + "summary": "MantisBT vulnerable to information disclosure with user profiles", + "details": "Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. \n\n### Impact\nDisclosure of private system profiles: Platform, OS, OS version, Description.\n\n### Patches\nWork in progress\n\n### Workarounds\nNone\n\n### References\nhttps://mantisbt.org/bugs/view.php?id=34640\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "mantisbt/mantisbt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.26.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.26.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7r" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45792" + }, + { + "type": "WEB", + "url": "https://github.com/mantisbt/mantisbt/commit/ef0f820284032350cc20a39ff9cb2010d5463b41" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mantisbt/mantisbt" + }, + { + "type": "WEB", + "url": "https://mantisbt.org/bugs/view.php?id=34640" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-30T17:48:15Z", + "nvd_published_at": "2024-09-30T15:15:05Z" + } +} \ No newline at end of file