diff --git a/advisories/github-reviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json b/advisories/github-reviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json new file mode 100644 index 00000000000..9fd8af2c15d --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3327-jr93-7hq3", + "modified": "2024-04-23T22:34:06Z", + "published": "2022-05-13T01:46:48Z", + "aliases": [ + "CVE-2017-6930" + ], + "summary": "Drupal access bypass vulnerability", + "details": "In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6930" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:34:06Z", + "nvd_published_at": "2018-03-01T23:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json b/advisories/github-reviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json rename to advisories/github-reviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json index 8194607bc4d..920779ff426 100644 --- a/advisories/unreviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json +++ b/advisories/github-reviewed/2022/05/GHSA-66mv-q8r2-hj8w/GHSA-66mv-q8r2-hj8w.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-66mv-q8r2-hj8w", - "modified": "2022-05-13T01:46:48Z", + "modified": "2024-04-23T22:34:12Z", "published": "2022-05-13T01:46:48Z", "aliases": [ "CVE-2017-6928" ], + "summary": "Drupal access bypass vulnerability", "details": "Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.", "severity": [ { @@ -14,13 +15,62 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.57" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.57" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6928" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6928.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6928.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html" @@ -39,8 +89,8 @@ "CWE-732" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:34:12Z", "nvd_published_at": "2018-03-01T23:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json b/advisories/github-reviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json new file mode 100644 index 00000000000..ecca826a434 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json @@ -0,0 +1,138 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hpj-9xj7-2jxx", + "modified": "2024-04-23T22:34:34Z", + "published": "2022-05-13T01:46:49Z", + "aliases": [ + "CVE-2017-6919" + ], + "summary": "Drupal access control bypass vulnerability", + "details": "Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.2.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.3.0" + }, + { + "fixed": "8.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.2.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.3.0" + }, + { + "fixed": "8.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6919" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-2017-002" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2017-002" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/97941" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1038371" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:34:34Z", + "nvd_published_at": "2017-04-20T02:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json b/advisories/github-reviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json new file mode 100644 index 00000000000..486d22ee7a0 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7ffh-cjvg-fpr4", + "modified": "2024-04-23T22:35:39Z", + "published": "2022-05-13T01:46:49Z", + "aliases": [ + "CVE-2017-6931" + ], + "summary": "Drupal Settings Tray access bypass", + "details": "In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6931" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6931.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6931.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:35:39Z", + "nvd_published_at": "2018-03-01T23:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json b/advisories/github-reviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json new file mode 100644 index 00000000000..aac3f0015fe --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f4qx-jqfq-7785", + "modified": "2024-04-23T22:33:46Z", + "published": "2022-05-13T01:46:48Z", + "aliases": [ + "CVE-2017-6925" + ], + "summary": "Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions", + "details": "In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.3.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.3.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6925" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6925.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6925.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2017-004" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/100368" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1039200" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:33:46Z", + "nvd_published_at": "2019-01-15T17:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json b/advisories/unreviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json deleted file mode 100644 index bf32c7abb3a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3327-jr93-7hq3/GHSA-3327-jr93-7hq3.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3327-jr93-7hq3", - "modified": "2022-05-13T01:46:48Z", - "published": "2022-05-13T01:46:48Z", - "aliases": [ - "CVE-2017-6930" - ], - "details": "In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6930" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2018-001" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-03-01T23:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json b/advisories/unreviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json deleted file mode 100644 index 8191c0c97ec..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-6hpj-9xj7-2jxx/GHSA-6hpj-9xj7-2jxx.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6hpj-9xj7-2jxx", - "modified": "2022-05-13T01:46:49Z", - "published": "2022-05-13T01:46:49Z", - "aliases": [ - "CVE-2017-6919" - ], - "details": "Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6919" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-CORE-2017-002" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/97941" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1038371" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-04-20T02:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json b/advisories/unreviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json deleted file mode 100644 index 00afed08f82..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-7ffh-cjvg-fpr4/GHSA-7ffh-cjvg-fpr4.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7ffh-cjvg-fpr4", - "modified": "2022-05-13T01:46:49Z", - "published": "2022-05-13T01:46:49Z", - "aliases": [ - "CVE-2017-6931" - ], - "details": "In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6931" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2018-001" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-434" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-03-01T23:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json b/advisories/unreviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json deleted file mode 100644 index ffc906d837f..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f4qx-jqfq-7785/GHSA-f4qx-jqfq-7785.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f4qx-jqfq-7785", - "modified": "2022-05-13T01:46:48Z", - "published": "2022-05-13T01:46:48Z", - "aliases": [ - "CVE-2017-6925" - ], - "details": "In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6925" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/100368" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1039200" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-01-15T17:29:00Z" - } -} \ No newline at end of file