Publish Advisories

GHSA-335x-5wcm-8jv2
GHSA-6324-52pr-h4p5
GHSA-7x74-h8cw-qhxq
GHSA-v98m-398x-269r
GHSA-xxc6-35r7-796w

advisories/github-reviewed/2023/12/GHSA-335x-5wcm-8jv2/GHSA-335x-5wcm-8jv2.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-335x-5wcm-8jv2",
-  "modified": "2023-12-13T13:21:51Z",
+  "modified": "2024-01-12T16:28:24Z",
   "published": "2023-12-13T13:21:51Z",
   "aliases": [
     "CVE-2023-48227"
   ],
   "summary": "Backoffice User can bypass \"Publish\" restriction",
-  "details": "#### Impact\nBackoffice users with send for approval permission but not publish permission are able to publish in some scenarios.\n",
+  "details": "#### Impact\nBackoffice users with send for approval permission but not publish permission are able to publish in some scenarios.\n\n#### Explanation of the vulnerability \nBackoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request body of the \"Send for Approval\" request.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2023/12/GHSA-6324-52pr-h4p5/GHSA-6324-52pr-h4p5.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6324-52pr-h4p5",
-  "modified": "2023-12-13T13:24:53Z",
+  "modified": "2024-01-12T16:28:06Z",
   "published": "2023-12-13T13:24:53Z",
   "aliases": [
     "CVE-2023-49089"
   ],
   "summary": "Using the directory back payload (“/../”) in a package name allows placement of package in other folders.",
-  "details": "#### Impact\nBackoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.\n",
+  "details": "#### Impact\nBackoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.\n\n#### Explanation of the vulnerability \nThe “Package” section in Umbraco Backoffice allows a logged in user to write folders outside of the default package directory.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2023/12/GHSA-7x74-h8cw-qhxq/GHSA-7x74-h8cw-qhxq.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7x74-h8cw-qhxq",
-  "modified": "2023-12-13T13:27:06Z",
+  "modified": "2024-01-12T16:27:48Z",
   "published": "2023-12-13T13:27:06Z",
   "aliases": [
     "CVE-2023-49278"
   ],
   "summary": " Brute force exploit can be used to collect valid usernames",
-  "details": "#### Impact\nA brute force exploit that can be used to collect valid usernames is possible.\n",
+  "details": "#### Impact\nA brute force exploit that can be used to collect valid usernames is possible.\n\n#### Explanation of the vulnerability \nIt's a brute force exploit that can be used to collect valid usernames by using the “forgot password” function when trying to log into the Backoffice.\nIf the username/email is known, it is easier to find the corresponding password.\nIf an email address that was already used and registered by a user, is provided as an input, the server internal processing time takes longer.\nIf the email address does not exist in the database of the registered users, the server would respond immediately.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2023/12/GHSA-v98m-398x-269r/GHSA-v98m-398x-269r.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v98m-398x-269r",
-  "modified": "2023-12-13T13:24:06Z",
+  "modified": "2024-01-12T16:28:41Z",
   "published": "2023-12-13T13:24:06Z",
   "aliases": [
     "CVE-2023-48313"
   ],
   "summary": "DOM-XSS on Backoffice login screen.",
-  "details": "#### Impact\nCross-site scripting (XSS) enable attackers to bring malicious content into a website or application.\n",
+  "details": "#### Impact\nCross-site scripting (XSS) enable attackers to bring malicious content into a website or application.\n\n#### Explanation of the vulnerability \n\nA DOM-XSS can be exploited when users are successfully logging into the Backoffice.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2023/12/GHSA-xxc6-35r7-796w/GHSA-xxc6-35r7-796w.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xxc6-35r7-796w",
-  "modified": "2023-12-13T13:17:37Z",
+  "modified": "2024-01-12T16:27:29Z",
   "published": "2023-12-13T13:17:37Z",
   "aliases": [
     "CVE-2023-38694"
   ],
   "summary": "Possible injection of HTML into user invite mails",
-  "details": "#### Impact\nA user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.\n",
+  "details": "#### Impact\nA user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.\n\n#### Explanation of the vulnerability \nA person with access to the backoffice and the \"users\" section could send a user invite and inject HTML code into the invite message.",
   "severity": [
     {
       "type": "CVSS_V3",