From f3c6595a21bc3769afdddfa863e841f7b68a3f54 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 20 Feb 2024 15:15:12 +0000
Subject: [PATCH] Publish Advisories

GHSA-3w4h-r27h-4r2w
GHSA-3w4h-r27h-4r2w
---
 .../GHSA-3w4h-r27h-4r2w.json                  | 143 ++++++++++++++++++
 .../GHSA-3w4h-r27h-4r2w.json                  |  35 -----
 2 files changed, 143 insertions(+), 35 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json b/advisories/github-reviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json
new file mode 100644
index 00000000000..53cb7251742
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json
@@ -0,0 +1,143 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3w4h-r27h-4r2w",
+  "modified": "2024-02-20T15:13:51Z",
+  "published": "2022-05-24T21:59:47Z",
+  "aliases": [
+    "CVE-2019-11832"
+  ],
+  "summary": "TYPO3 Image Processing susceptible to Code Execution",
+  "details": "TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.\nFor a successful exploit, the GhostScript binary `gs` must be available on the server system.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.7.25"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.5.6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.7.25"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.5.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11832"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/github/advisory-database/pull/3530"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/TYPO3/typo3/commit/2c04eeac44733fda491f92c697f88c1337d19c79"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/TYPO3/typo3/commit/51fdb774a57ee30e8d60c0e33b4a0b92d775739e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/TYPO3/typo3/commit/e845d90b82b2f72ab12a9e37f15082297832beca"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-11832.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-11832.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/TYPO3/typo3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20",
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-20T15:13:51Z",
+    "nvd_published_at": "2019-05-09T05:29:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json b/advisories/unreviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json
deleted file mode 100644
index a3ee29bb9df..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-3w4h-r27h-4r2w",
-  "modified": "2022-05-24T21:59:47Z",
-  "published": "2022-05-24T21:59:47Z",
-  "aliases": [
-    "CVE-2019-11832"
-  ],
-  "details": "TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11832"
-    },
-    {
-      "type": "WEB",
-      "url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2019-05-09T05:29:00Z"
-  }
-}
\ No newline at end of file