From f450d6269fd696948553584a7f596c91f0f21f9c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 23:44:36 +0000 Subject: [PATCH] Publish Advisories GHSA-332g-xh34-5c96 GHSA-54r2-r67g-fr9m GHSA-rjh8-w8jg-xwq5 GHSA-xhfw-wjjc-4j5h GHSA-xhq3-455r-xv44 GHSA-2hmm-q272-xmhf GHSA-385f-vgq7-8hhx GHSA-mqw9-3cjm-xwp3 GHSA-xjr3-fwp9-9g96 GHSA-6gx2-g773-hv9h GHSA-xv72-6pgh-cjj8 GHSA-332g-xh34-5c96 GHSA-54r2-r67g-fr9m GHSA-rjh8-w8jg-xwq5 GHSA-xhfw-wjjc-4j5h GHSA-xhq3-455r-xv44 GHSA-2hmm-q272-xmhf GHSA-385f-vgq7-8hhx GHSA-mqw9-3cjm-xwp3 GHSA-xjr3-fwp9-9g96 --- .../GHSA-332g-xh34-5c96.json | 122 ++++++++++++++++ .../GHSA-54r2-r67g-fr9m.json | 103 ++++++++++++++ .../GHSA-rjh8-w8jg-xwq5.json | 103 ++++++++++++++ .../GHSA-xhfw-wjjc-4j5h.json | 122 ++++++++++++++++ .../GHSA-xhq3-455r-xv44.json | 130 ++++++++++++++++++ .../GHSA-2hmm-q272-xmhf.json | 107 ++++++++++++++ .../GHSA-385f-vgq7-8hhx.json | 104 ++++++++++++++ .../GHSA-mqw9-3cjm-xwp3.json | 103 ++++++++++++++ .../GHSA-xjr3-fwp9-9g96.json | 84 +++++++++++ .../GHSA-6gx2-g773-hv9h.json | 69 +++++++++- .../GHSA-xv72-6pgh-cjj8.json | 50 ++++++- .../GHSA-332g-xh34-5c96.json | 42 ------ .../GHSA-54r2-r67g-fr9m.json | 42 ------ .../GHSA-rjh8-w8jg-xwq5.json | 42 ------ .../GHSA-xhfw-wjjc-4j5h.json | 42 ------ .../GHSA-xhq3-455r-xv44.json | 50 ------- .../GHSA-2hmm-q272-xmhf.json | 42 ------ .../GHSA-385f-vgq7-8hhx.json | 42 ------ .../GHSA-mqw9-3cjm-xwp3.json | 42 ------ .../GHSA-xjr3-fwp9-9g96.json | 42 ------ 20 files changed, 1089 insertions(+), 394 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json create mode 100644 advisories/github-reviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json create mode 100644 advisories/github-reviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json create mode 100644 advisories/github-reviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json create mode 100644 advisories/github-reviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json rename advisories/{unreviewed => github-reviewed}/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json (63%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json delete mode 100644 advisories/unreviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json delete mode 100644 advisories/unreviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json delete mode 100644 advisories/unreviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json delete mode 100644 advisories/unreviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json diff --git a/advisories/github-reviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json b/advisories/github-reviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json new file mode 100644 index 00000000000..438ead988ab --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-332g-xh34-5c96", + "modified": "2024-04-23T23:42:08Z", + "published": "2022-05-14T03:46:14Z", + "aliases": [ + "CVE-2018-1044" + ], + "summary": "Moodle Privilege escalation in quiz web services", + "details": "In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1044" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=364383" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/102754" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:42:08Z", + "nvd_published_at": "2018-01-22T08:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json b/advisories/github-reviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json new file mode 100644 index 00000000000..e224eff897a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54r2-r67g-fr9m", + "modified": "2024-04-23T23:42:19Z", + "published": "2022-05-17T02:27:46Z", + "aliases": [ + "CVE-2017-2642" + ], + "summary": "Moodle User fullname disclosure on user preferences page", + "details": "Moodle 3.x has user fullname disclosure on the user preferences page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2642" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=355554" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/99606" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:42:19Z", + "nvd_published_at": "2017-07-17T17:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json b/advisories/github-reviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json new file mode 100644 index 00000000000..a7806c0bead --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rjh8-w8jg-xwq5", + "modified": "2024-04-23T23:42:11Z", + "published": "2022-05-17T00:18:11Z", + "aliases": [ + "CVE-2017-15110" + ], + "summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor", + "details": "In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15110" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=361784" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/101909" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:42:11Z", + "nvd_published_at": "2017-11-20T14:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json b/advisories/github-reviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json new file mode 100644 index 00000000000..2354e2f2ab6 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhfw-wjjc-4j5h", + "modified": "2024-04-23T23:43:39Z", + "published": "2022-05-13T01:49:13Z", + "aliases": [ + "CVE-2018-1136" + ], + "summary": "Moodle Cross-site Scripting", + "details": "An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4" + }, + { + "fixed": "3.4.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1136" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=371202" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/104307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:39Z", + "nvd_published_at": "2018-05-25T12:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json b/advisories/github-reviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json new file mode 100644 index 00000000000..ab65d432df5 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhq3-455r-xv44", + "modified": "2024-04-23T23:42:15Z", + "published": "2022-05-17T02:12:39Z", + "aliases": [ + "CVE-2017-2641" + ], + "summary": "Moodle SQL injection via user preferences", + "details": "In Moodle 2.x and 3.x, SQL injection can occur via user preferences.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.19" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2641" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=349419" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/41828" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/96977" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1038174" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:42:15Z", + "nvd_published_at": "2017-03-26T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json b/advisories/github-reviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json new file mode 100644 index 00000000000..257da04593f --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2hmm-q272-xmhf", + "modified": "2024-04-23T23:43:09Z", + "published": "2022-10-01T00:00:20Z", + "aliases": [ + "CVE-2022-40314" + ], + "summary": "Moodle remote code execution", + "details": "A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.9.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40314" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128147" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=438393" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75405" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:09Z", + "nvd_published_at": "2022-09-30T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json b/advisories/github-reviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json new file mode 100644 index 00000000000..75e84fdcb81 --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-385f-vgq7-8hhx", + "modified": "2024-04-23T23:43:22Z", + "published": "2022-10-01T00:00:20Z", + "aliases": [ + "CVE-2022-40316" + ], + "summary": "Moodle No groups filtering in H5P activity attempts report", + "details": "The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9" + }, + { + "fixed": "3.9.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40316" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128151" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=438395" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-668", + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:22Z", + "nvd_published_at": "2022-09-30T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json b/advisories/github-reviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json new file mode 100644 index 00000000000..c01de007d48 --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqw9-3cjm-xwp3", + "modified": "2024-04-23T23:43:17Z", + "published": "2022-10-01T00:00:20Z", + "aliases": [ + "CVE-2022-40315" + ], + "summary": "Moodle Minor SQL injection risk in admin user browsing", + "details": "A limited SQL injection risk was identified in the \"browse list of users\" site administration page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9" + }, + { + "fixed": "3.9.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40315" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128150" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=438394" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:17Z", + "nvd_published_at": "2022-09-30T17:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json b/advisories/github-reviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json new file mode 100644 index 00000000000..d6d267a2fcf --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjr3-fwp9-9g96", + "modified": "2024-04-23T23:43:26Z", + "published": "2022-10-06T18:52:03Z", + "aliases": [ + "CVE-2022-2986" + ], + "summary": "Moodle Cross-Site Request Forgery (CSRF)", + "details": "Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2986" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2121360" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:26Z", + "nvd_published_at": "2022-10-06T18:16:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json b/advisories/github-reviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json similarity index 59% rename from advisories/unreviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json rename to advisories/github-reviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json index 57b2612728e..07b9447a051 100644 --- a/advisories/unreviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json +++ b/advisories/github-reviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-6gx2-g773-hv9h", - "modified": "2022-11-26T06:31:18Z", + "modified": "2024-04-23T23:43:31Z", "published": "2022-11-23T15:30:21Z", "aliases": [ "CVE-2022-45150" ], + "summary": "Moodle reflected cross-site scripting vulnerability in policy tool", "details": "A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.", "severity": [ { @@ -14,7 +15,63 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9" + }, + { + "fixed": "3.9.18" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.5" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +82,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142773" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2" @@ -51,8 +112,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:31Z", "nvd_published_at": "2022-11-23T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json b/advisories/github-reviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json similarity index 63% rename from advisories/unreviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json rename to advisories/github-reviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json index 5d7046d76f1..3c9a8c5f5ff 100644 --- a/advisories/unreviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json +++ b/advisories/github-reviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xv72-6pgh-cjj8", - "modified": "2022-11-26T06:31:17Z", + "modified": "2024-04-23T23:43:35Z", "published": "2022-11-23T15:30:21Z", "aliases": [ "CVE-2022-45151" ], + "summary": "Moodle stored-XSS vulnerability in some \"social\" user profile fields", "details": "The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several \"social\" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.", "severity": [ { @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.11" + }, + { + "fixed": "3.11.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.0.5" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +63,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142774" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2" @@ -51,8 +93,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:43:35Z", "nvd_published_at": "2022-11-23T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json b/advisories/unreviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json deleted file mode 100644 index 5b040a3ce7f..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-332g-xh34-5c96", - "modified": "2022-05-14T03:46:14Z", - "published": "2022-05-14T03:46:14Z", - "aliases": [ - "CVE-2018-1044" - ], - "details": "In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1044" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=364383" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/102754" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-01-22T08:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json b/advisories/unreviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json deleted file mode 100644 index a1047c9349f..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-54r2-r67g-fr9m", - "modified": "2022-05-17T02:27:46Z", - "published": "2022-05-17T02:27:46Z", - "aliases": [ - "CVE-2017-2642" - ], - "details": "Moodle 3.x has user fullname disclosure on the user preferences page.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2642" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=355554" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/99606" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-07-17T17:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json b/advisories/unreviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json deleted file mode 100644 index 7972236c603..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rjh8-w8jg-xwq5", - "modified": "2022-05-17T00:18:11Z", - "published": "2022-05-17T00:18:11Z", - "aliases": [ - "CVE-2017-15110" - ], - "details": "In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15110" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=361784" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/101909" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-11-20T14:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json b/advisories/unreviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json deleted file mode 100644 index 11dd23354ec..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xhfw-wjjc-4j5h", - "modified": "2022-05-13T01:49:13Z", - "published": "2022-05-13T01:49:13Z", - "aliases": [ - "CVE-2018-1136" - ], - "details": "An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1136" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=371202" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/104307" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-05-25T12:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json b/advisories/unreviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json deleted file mode 100644 index bf8b4058d05..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xhq3-455r-xv44", - "modified": "2022-05-17T02:12:39Z", - "published": "2022-05-17T02:12:39Z", - "aliases": [ - "CVE-2017-2641" - ], - "details": "In Moodle 2.x and 3.x, SQL injection can occur via user preferences.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2641" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=349419" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/41828" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/96977" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1038174" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-03-26T18:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json b/advisories/unreviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json deleted file mode 100644 index 1da297d17e7..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2hmm-q272-xmhf", - "modified": "2022-10-05T00:00:38Z", - "published": "2022-10-01T00:00:20Z", - "aliases": [ - "CVE-2022-40314" - ], - "details": "A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40314" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128147" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=438393" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-09-30T17:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json b/advisories/unreviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json deleted file mode 100644 index 3d3b8552fab..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-385f-vgq7-8hhx", - "modified": "2022-10-05T00:00:38Z", - "published": "2022-10-01T00:00:20Z", - "aliases": [ - "CVE-2022-40316" - ], - "details": "The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40316" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128151" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=438395" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-668" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-09-30T17:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json b/advisories/unreviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json deleted file mode 100644 index f2ee6df20fc..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mqw9-3cjm-xwp3", - "modified": "2022-10-05T00:00:38Z", - "published": "2022-10-01T00:00:20Z", - "aliases": [ - "CVE-2022-40315" - ], - "details": "A limited SQL injection risk was identified in the \"browse list of users\" site administration page.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40315" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128150" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=438394" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-09-30T17:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json b/advisories/unreviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json deleted file mode 100644 index cada75216f1..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xjr3-fwp9-9g96", - "modified": "2022-10-07T18:15:43Z", - "published": "2022-10-06T18:52:03Z", - "aliases": [ - "CVE-2022-2986" - ], - "details": "Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2986" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2121360" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-10-06T18:16:00Z" - } -} \ No newline at end of file