From eca15c73bb098d25520a3525280f87fa0a2d2cdd Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 29 Oct 2024 16:14:07 +0000 Subject: [PATCH] Publish Advisories GHSA-762g-9p7f-mrww GHSA-762v-rq7q-ff97 GHSA-g376-m3h3-mj4r --- .../GHSA-762g-9p7f-mrww.json | 35 ++++++++++++++++--- .../GHSA-762v-rq7q-ff97.json | 35 ++++++++++++++++--- .../GHSA-g376-m3h3-mj4r.json | 35 ++++++++++++++++--- 3 files changed, 93 insertions(+), 12 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json (52%) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json (55%) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json (52%) diff --git a/advisories/unreviewed/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json b/advisories/github-reviewed/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json similarity index 52% rename from advisories/unreviewed/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json rename to advisories/github-reviewed/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json index 776dddada8c..5fe55658df8 100644 --- a/advisories/unreviewed/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json +++ b/advisories/github-reviewed/2024/10/GHSA-762g-9p7f-mrww/GHSA-762g-9p7f-mrww.json @@ -1,26 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-762g-9p7f-mrww", - "modified": "2024-10-29T09:30:51Z", + "modified": "2024-10-29T16:13:08Z", "published": "2024-10-29T09:30:51Z", "aliases": [ "CVE-2024-46872" ], + "summary": "Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery", "details": "Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20240926115259-20ed58906adc" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46872" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-10-29T16:13:08Z", "nvd_published_at": "2024-10-29T09:15:07Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json b/advisories/github-reviewed/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json similarity index 55% rename from advisories/unreviewed/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json rename to advisories/github-reviewed/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json index e55d88d7cd9..4c5dde647c1 100644 --- a/advisories/unreviewed/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json +++ b/advisories/github-reviewed/2024/10/GHSA-762v-rq7q-ff97/GHSA-762v-rq7q-ff97.json @@ -1,26 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-762v-rq7q-ff97", - "modified": "2024-10-29T09:30:51Z", + "modified": "2024-10-29T16:13:16Z", "published": "2024-10-29T09:30:51Z", "aliases": [ "CVE-2024-47401" ], + "summary": "Mattermost Server vulnerable to application crash from attacker-generated large response", "details": "Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20240926115259-20ed58906adc" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47401" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-770" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-10-29T16:13:16Z", "nvd_published_at": "2024-10-29T09:15:07Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json b/advisories/github-reviewed/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json similarity index 52% rename from advisories/unreviewed/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json rename to advisories/github-reviewed/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json index ad5a571fd32..59cd7d54e87 100644 --- a/advisories/unreviewed/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json +++ b/advisories/github-reviewed/2024/10/GHSA-g376-m3h3-mj4r/GHSA-g376-m3h3-mj4r.json @@ -1,26 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-g376-m3h3-mj4r", - "modified": "2024-10-29T09:30:51Z", + "modified": "2024-10-29T16:13:12Z", "published": "2024-10-29T09:30:51Z", "aliases": [ "CVE-2024-50052" ], + "summary": "Mattermost server allows authenticated user to delete arbitrary post", "details": "Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20240926115259-20ed58906adc" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50052" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-10-29T16:13:12Z", "nvd_published_at": "2024-10-29T08:15:12Z" } } \ No newline at end of file