diff --git a/advisories/github-reviewed/2024/09/GHSA-pg4m-3gp6-hw4w/GHSA-pg4m-3gp6-hw4w.json b/advisories/github-reviewed/2024/09/GHSA-pg4m-3gp6-hw4w/GHSA-pg4m-3gp6-hw4w.json new file mode 100644 index 00000000000..cd522a03181 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-pg4m-3gp6-hw4w/GHSA-pg4m-3gp6-hw4w.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pg4m-3gp6-hw4w", + "modified": "2024-09-18T14:26:20Z", + "published": "2024-09-18T14:26:20Z", + "aliases": [ + "CVE-2024-46979" + ], + "summary": "org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users", + "details": "### Impact\n\nIt's possible to get access to notification filters of any user by using a URL such as `xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?outputSyntax=plain&type=custom&user=`. This vulnerability impacts all versions of XWiki since 13.2-rc-1.\nThe filters do not provide much information (they mainly contain references which are public data in XWiki), though some info could be used in combination with other vulnerabilities.\n\n### Patches\n\nThe vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0RC1. \nThe patch consists in checking the rights of the user when sending the data.\n\n### Workarounds\n\nIt's possible to workaround the vulnerability by applying manually the patch: it's possible for an administrator to edit directly the document `XWiki.Notifications.Code.NotificationFilterPreferenceLivetableResults` to apply the same changes as in the patch. See c8c6545f9bde6f5aade994aa5b5903a67b5c2582.\n\n### References\n\n * Jira ticket: https://jira.xwiki.org/browse/XWIKI-20336\n * Commit: c8c6545f9bde6f5aade994aa5b5903a67b5c2582\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been reported on Intigriti by [Mete](https://www.linkedin.com/in/metehan-kalkan-5a3201199).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-notifications-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.2-rc-1" + }, + { + "fixed": "14.10.21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-notifications-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0-rc-1" + }, + { + "fixed": "15.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-notifications-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.6-rc-1" + }, + { + "fixed": "15.10.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pg4m-3gp6-hw4w" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/29e5edbb2b7068ada17290cea41e0aa8144e1294" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/a0352922a1a61e0e858a9be89d73f0665630a63a" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/ed090d1aa228848d3860968c437b72db3b09119f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki/xwiki-platform" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-20336" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-18T14:26:20Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-r95w-889q-x2gx/GHSA-r95w-889q-x2gx.json b/advisories/github-reviewed/2024/09/GHSA-r95w-889q-x2gx/GHSA-r95w-889q-x2gx.json new file mode 100644 index 00000000000..0629139e784 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-r95w-889q-x2gx/GHSA-r95w-889q-x2gx.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r95w-889q-x2gx", + "modified": "2024-09-18T14:26:16Z", + "published": "2024-09-18T14:26:16Z", + "aliases": [ + "CVE-2024-46978" + ], + "summary": "org.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions", + "details": "### Impact\n\nIt's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this.\nThis vulnerability is present in XWiki since 13.2-rc-1. \n\n### Patches\n\nThe vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. \n\n### Workarounds\n\nIt's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in this commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4.\n\n### References\n\n * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-20337\n * Commit: e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been reported on Intigriti by @floerer", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-notifications-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.2-rc-1" + }, + { + "fixed": "14.10.21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-notifications-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0-rc-1" + }, + { + "fixed": "15.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-notifications-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.6-rc-1" + }, + { + "fixed": "15.10.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/4771573dac88e0cf04e30f1a8dfa183c048d503a" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/99193a7e9a203b5bb8b2583ac96f5f4d56b9aa1a" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/b9180b874a22e383ad5f2cd9e25bfed4594d4955" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki/xwiki-platform" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-20337" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-648" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-18T14:26:16Z", + "nvd_published_at": null + } +} \ No newline at end of file