netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3327-jr93-7hq3
GHSA-66mv-q8r2-hj8w
GHSA-6hpj-9xj7-2jxx
GHSA-7ffh-cjvg-fpr4
GHSA-f4qx-jqfq-7785
GHSA-3327-jr93-7hq3
GHSA-6hpj-9xj7-2jxx
GHSA-7ffh-cjvg-fpr4
GHSA-f4qx-jqfq-7785
This commit is contained in:
advisory-database[bot]
2024-04-23 22:36:08 +00:00
parent 68a639411b
commit f028c0bd6b
9 changed files with 468 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json
+88
View File
@@ -0,0 +1,88 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3327-jr93-7hq3",
"modified": "2024-04-23T22:34:06Z",
"published": "2022-05-13T01:46:48Z",
"aliases": [
"CVE-2017-6930"
],
"summary": "Drupal access bypass vulnerability",
"details": "In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6930"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:34:06Z",
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json → advisories/github-reviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json
+54 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-66mv-q8r2-hj8w",
"modified": "2022-05-13T01:46:48Z",
"modified": "2024-04-23T22:34:12Z",
"published": "2022-05-13T01:46:48Z",
"aliases": [
"CVE-2017-6928"
],
"summary": "Drupal access bypass vulnerability",
"details": "Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.",
"severity": [
{
@@ -14,13 +15,62 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.57"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.57"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6928"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6928.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6928.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"
@@ -39,8 +89,8 @@
"CWE-732"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:34:12Z",
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json
+138
View File
@@ -0,0 +1,138 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hpj-9xj7-2jxx",
"modified": "2024-04-23T22:34:34Z",
"published": "2022-05-13T01:46:49Z",
"aliases": [
"CVE-2017-6919"
],
"summary": "Drupal access control bypass vulnerability",
"details": "Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.2.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.3.0"
},
{
"fixed": "8.3.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.2.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.3.0"
},
{
"fixed": "8.3.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6919"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-2017-002"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-CORE-2017-002"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97941"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038371"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:34:34Z",
"nvd_published_at": "2017-04-20T02:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json
+88
View File
@@ -0,0 +1,88 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7ffh-cjvg-fpr4",
"modified": "2024-04-23T22:35:39Z",
"published": "2022-05-13T01:46:49Z",
"aliases": [
"CVE-2017-6931"
],
"summary": "Drupal Settings Tray access bypass",
"details": "In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6931"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6931.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6931.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:35:39Z",
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json
+100
View File
@@ -0,0 +1,100 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f4qx-jqfq-7785",
"modified": "2024-04-23T22:33:46Z",
"published": "2022-05-13T01:46:48Z",
"aliases": [
"CVE-2017-6925"
],
"summary": "Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions",
"details": "In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.3.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.3.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6925"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6925.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6925.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-CORE-2017-004"
},
{
"type": "WEB",
"url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100368"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039200"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:33:46Z",
"nvd_published_at": "2019-01-15T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3327-jr93-7hq3",
"modified": "2022-05-13T01:46:48Z",
"published": "2022-05-13T01:46:48Z",
"aliases": [
"CVE-2017-6930"
],
"details": "In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6930"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hpj-9xj7-2jxx",
"modified": "2022-05-13T01:46:49Z",
"published": "2022-05-13T01:46:49Z",
"aliases": [
"CVE-2017-6919"
],
"details": "Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6919"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-CORE-2017-002"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97941"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038371"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-20T02:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7ffh-cjvg-fpr4",
"modified": "2022-05-13T01:46:49Z",
"published": "2022-05-13T01:46:49Z",
"aliases": [
"CVE-2017-6931"
],
"details": "In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6931"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f4qx-jqfq-7785",
"modified": "2022-05-13T01:46:48Z",
"published": "2022-05-13T01:46:48Z",
"aliases": [
"CVE-2017-6925"
],
"details": "In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6925"
},
{
"type": "WEB",
"url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100368"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039200"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-15T17:29:00Z"
}
}