From ee7262f66c1fef86b71f8a31a0001daee6f6c42a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Feb 2024 00:07:00 +0000 Subject: [PATCH] Publish Advisories GHSA-3366-9287-7qpr GHSA-6vjf-48fh-vxxj GHSA-cp8m-h777-g4p3 GHSA-q3gg-m8hr-h4x4 GHSA-xfg6-62px-cxc2 GHSA-6vjf-48fh-vxxj GHSA-cp8m-h777-g4p3 GHSA-xfg6-62px-cxc2 --- .../GHSA-3366-9287-7qpr.json | 69 ++++++++ .../GHSA-6vjf-48fh-vxxj.json | 111 ++++++++++++ .../GHSA-cp8m-h777-g4p3.json | 111 ++++++++++++ .../GHSA-q3gg-m8hr-h4x4.json | 65 +++++++ .../GHSA-xfg6-62px-cxc2.json | 164 ++++++++++++++++++ .../GHSA-6vjf-48fh-vxxj.json | 46 ----- .../GHSA-cp8m-h777-g4p3.json | 46 ----- .../GHSA-xfg6-62px-cxc2.json | 38 ---- 8 files changed, 520 insertions(+), 130 deletions(-) create mode 100644 advisories/github-reviewed/2024/02/GHSA-3366-9287-7qpr/GHSA-3366-9287-7qpr.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-q3gg-m8hr-h4x4/GHSA-q3gg-m8hr-h4x4.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json diff --git a/advisories/github-reviewed/2024/02/GHSA-3366-9287-7qpr/GHSA-3366-9287-7qpr.json b/advisories/github-reviewed/2024/02/GHSA-3366-9287-7qpr/GHSA-3366-9287-7qpr.json new file mode 100644 index 00000000000..b55b4ed1bf9 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-3366-9287-7qpr/GHSA-3366-9287-7qpr.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3366-9287-7qpr", + "modified": "2024-02-21T00:04:24Z", + "published": "2024-02-21T00:04:24Z", + "aliases": [ + "CVE-2024-26129" + ], + "summary": "Path disclosure in JavaScript variable", + "details": "### Impact\nPath disclosure in JavaScript variable\n\n### Patches\nPatch in PrestaShop 8.1.4\n\n### References\nhttps://owasp.org/www-community/attacks/Full_Path_Disclosure\n\nThanks to https://github.com/hugo-fasone\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "prestashop/prestashop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.1.0" + }, + { + "fixed": "8.1.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26129" + }, + { + "type": "WEB", + "url": "https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PrestaShop/PrestaShop" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/attacks/Full_Path_Disclosure" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:04:24Z", + "nvd_published_at": "2024-02-19T22:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json b/advisories/github-reviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json new file mode 100644 index 00000000000..354687ac9dc --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vjf-48fh-vxxj", + "modified": "2024-02-21T00:05:33Z", + "published": "2024-02-19T18:31:32Z", + "aliases": [ + "CVE-2024-25979" + ], + "summary": "Improper Handling of Parameters in moodle", + "details": "The URL parameters accepted by forum search were not limited to the allowed parameters.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25979" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/6eaeeda6cf759672def05a85afe9e4d521739166" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264095" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=455635" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69774" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-233" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:05:33Z", + "nvd_published_at": "2024-02-19T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json b/advisories/github-reviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json new file mode 100644 index 00000000000..9743295132d --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cp8m-h777-g4p3", + "modified": "2024-02-21T00:06:05Z", + "published": "2024-02-19T18:31:32Z", + "aliases": [ + "CVE-2024-25980" + ], + "summary": "Improper Access Control in moodle", + "details": "Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25980" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/662192fcecdefdaae79f55db96bd64dbcdeef85b" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264096" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=455636" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:06:04Z", + "nvd_published_at": "2024-02-19T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-q3gg-m8hr-h4x4/GHSA-q3gg-m8hr-h4x4.json b/advisories/github-reviewed/2024/02/GHSA-q3gg-m8hr-h4x4/GHSA-q3gg-m8hr-h4x4.json new file mode 100644 index 00000000000..7a37d630955 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-q3gg-m8hr-h4x4/GHSA-q3gg-m8hr-h4x4.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q3gg-m8hr-h4x4", + "modified": "2024-02-21T00:04:05Z", + "published": "2024-02-21T00:04:05Z", + "aliases": [ + + ], + "summary": "Externally Controlled Format String in Scripting Functions", + "details": "The `rquickjs` crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The `rquickjs` function `Exception::throw_type` takes a string and returns an error object. Prior to version `0.4.2` of the crate, this string would be fed directly into `printf`, which will receive the error string as a format string with no additional arguments, leading to undefined behavior. This issue triggers when a SurrealDB scripting function returns an error and its input contains a format string such as `%s` or `%d`. \n\nThis vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with `--allow-scripting` or `--allow-all` and equivalent environment variables `SURREAL_CAPS_ALLOW_SCRIPT=true` and `SURREAL_CAPS_ALLOW_ALL=true`.\n\n### Impact\n\nAn attacker with privileges to execute scripting functions with arbitrary inputs may be able to exploit this format string vulnerability in order read arbitrary memory from the remote SurrealDB process. A format string vulnerability may also be further exploited to execute arbitrary code with the privileges of the SurrealDB process.\n\nThe fact that error messages are limited to 256 bytes coupled with [exploit mitigation features supported in Rust executables](https://doc.rust-lang.org/rustc/exploit-mitigations.html#exploit-mitigations-1) may somewhat increase the complexity of exploiting this vulnerability to reliably achieve remote code execution in practice.\n\n### Patches\n\n- Version 1.1.1 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to update should restrict access from untrusted users to define and execute scripting functions. This can be achieved by removing the scripting capability by default or with `--deny-scripting` and equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. If not possible, network access should be limited to trusted users.\n\n### References\n\n- https://github.com/surrealdb/surrealdb/issues/3327\n- https://github.com/surrealdb/surrealdb/pull/3332\n- https://github.com/DelSkayn/rquickjs/pull/247", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/issues/3327" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/3332" + }, + { + "type": "PACKAGE", + "url": "https://github.com/surrealdb/surrealdb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:04:05Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json b/advisories/github-reviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json new file mode 100644 index 00000000000..a6c6a8c61ab --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json @@ -0,0 +1,164 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xfg6-62px-cxc2", + "modified": "2024-02-21T00:04:53Z", + "published": "2024-02-19T15:30:38Z", + "aliases": [ + "CVE-2024-1597" + ], + "summary": "SQL injection in pgjdbc", + "details": "pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.7.0" + }, + { + "fixed": "42.7.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.6.0" + }, + { + "fixed": "42.6.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.5.0" + }, + { + "fixed": "42.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.4.0" + }, + { + "fixed": "42.4.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.3.0" + }, + { + "fixed": "42.3.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "42.2.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1597" + }, + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee" + }, + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgjdbc/pgjdbc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:04:53Z", + "nvd_published_at": "2024-02-19T13:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json b/advisories/unreviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json deleted file mode 100644 index 1198ccf395b..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6vjf-48fh-vxxj", - "modified": "2024-02-19T18:31:32Z", - "published": "2024-02-19T18:31:32Z", - "aliases": [ - "CVE-2024-25979" - ], - "details": "The URL parameters accepted by forum search were not limited to the allowed parameters.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25979" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264095" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=455635" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69774" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-233" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T17:15:08Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json b/advisories/unreviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json deleted file mode 100644 index b487a36e966..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-cp8m-h777-g4p3", - "modified": "2024-02-19T18:31:32Z", - "published": "2024-02-19T18:31:32Z", - "aliases": [ - "CVE-2024-25980" - ], - "details": "Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25980" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264096" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=455636" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T17:15:09Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json b/advisories/unreviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json deleted file mode 100644 index 3160b555edf..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xfg6-62px-cxc2", - "modified": "2024-02-19T15:30:38Z", - "published": "2024-02-19T15:30:38Z", - "aliases": [ - "CVE-2024-1597" - ], - "details": "pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1597" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-19T13:15:07Z" - } -} \ No newline at end of file