diff --git a/advisories/unreviewed/2024/12/GHSA-6569-3785-r3v6/GHSA-6569-3785-r3v6.json b/advisories/github-reviewed/2024/12/GHSA-6569-3785-r3v6/GHSA-6569-3785-r3v6.json similarity index 65% rename from advisories/unreviewed/2024/12/GHSA-6569-3785-r3v6/GHSA-6569-3785-r3v6.json rename to advisories/github-reviewed/2024/12/GHSA-6569-3785-r3v6/GHSA-6569-3785-r3v6.json index b60d29b4a38..08921d01170 100644 --- a/advisories/unreviewed/2024/12/GHSA-6569-3785-r3v6/GHSA-6569-3785-r3v6.json +++ b/advisories/github-reviewed/2024/12/GHSA-6569-3785-r3v6/GHSA-6569-3785-r3v6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-6569-3785-r3v6", - "modified": "2024-12-18T06:30:49Z", + "modified": "2024-12-18T15:44:45Z", "published": "2024-12-18T06:30:49Z", "aliases": [ "CVE-2024-21546" ], + "summary": "UniSharp Laravel Filemanager Code Injection vulnerability", "details": "Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.", "severity": [ { @@ -14,10 +15,30 @@ }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "unisharp/laravel-filemanager" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.1" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -31,6 +52,10 @@ "type": "WEB", "url": "https://gist.github.com/ImHades101/338a06816ef97262ba632af9c78b78ca" }, + { + "type": "PACKAGE", + "url": "https://github.com/UniSharp/laravel-filemanager" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-7210316" @@ -41,8 +66,8 @@ "CWE-94" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-18T15:44:45Z", "nvd_published_at": "2024-12-18T06:15:22Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json b/advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json similarity index 71% rename from advisories/unreviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json rename to advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json index cb24dc32700..98c6ddc99d5 100644 --- a/advisories/unreviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json +++ b/advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jhh6-6fhp-q2xp", - "modified": "2024-12-18T00:31:23Z", + "modified": "2024-12-18T15:43:48Z", "published": "2024-12-18T00:31:23Z", "aliases": [ "CVE-2024-9779" ], + "summary": "Open Cluster Management vulnerable to Trust Boundary Violation", "details": "A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name \"cluster-manager\" which is bound to a ClusterRole also named \"cluster-manager\", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "open-cluster-management.io/ocm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.13.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -35,6 +56,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317916" }, + { + "type": "PACKAGE", + "url": "https://github.com/open-cluster-management-io/OCM" + }, { "type": "WEB", "url": "https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0" @@ -45,8 +70,8 @@ "CWE-501" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-18T15:43:48Z", "nvd_published_at": "2024-12-17T23:15:05Z" } } \ No newline at end of file