From f9a14a4ad54dca092a06e61b3f0a8723a6623685 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 10 Mar 2025 22:28:16 +0000 Subject: [PATCH] Publish Advisories GHSA-c3q9-q986-vrwh GHSA-pvmx-mjmh-jfcx --- .../GHSA-c3q9-q986-vrwh.json | 37 ++++++++++++++++-- .../GHSA-pvmx-mjmh-jfcx.json | 38 ++++++++++++++++--- 2 files changed, 65 insertions(+), 10 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json (55%) rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json (64%) diff --git a/advisories/unreviewed/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json b/advisories/github-reviewed/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json similarity index 55% rename from advisories/unreviewed/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json rename to advisories/github-reviewed/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json index 21a0fe1aee0..a1ac065321b 100644 --- a/advisories/unreviewed/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json +++ b/advisories/github-reviewed/2025/03/GHSA-c3q9-q986-vrwh/GHSA-c3q9-q986-vrwh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c3q9-q986-vrwh", - "modified": "2025-03-10T18:31:57Z", + "modified": "2025-03-10T22:25:55Z", "published": "2025-03-10T18:31:57Z", "aliases": [ "CVE-2025-1296" ], + "summary": "Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs", "details": "Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.", "severity": [ { @@ -13,15 +14,43 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/nomad" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.9.6" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1296" }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/nomad/commit/dc482bf9058faf7a192486eb52caa1d42646f6b3" + }, { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737" + }, + { + "type": "PACKAGE", + "url": "https://github.com/hashicorp/nomad" } ], "database_specific": { @@ -29,8 +58,8 @@ "CWE-532" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T22:25:55Z", "nvd_published_at": "2025-03-10T18:15:30Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json b/advisories/github-reviewed/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json similarity index 64% rename from advisories/unreviewed/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json rename to advisories/github-reviewed/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json index f1845249d01..40a870eb4c3 100644 --- a/advisories/unreviewed/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json +++ b/advisories/github-reviewed/2025/03/GHSA-pvmx-mjmh-jfcx/GHSA-pvmx-mjmh-jfcx.json @@ -1,19 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-pvmx-mjmh-jfcx", - "modified": "2025-03-10T21:31:12Z", + "modified": "2025-03-10T22:26:16Z", "published": "2025-03-10T21:31:12Z", "aliases": [ "CVE-2025-0660" ], + "summary": "Concrete CMS affected by a stored XSS in Folder Function.The \"Add Folder\" functionality", "details": "Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The \"Add Folder\" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names.  The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Versions below 9 are not affected. Thanks, Alfin Joseph for reporting.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.4.0RC1" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -30,15 +51,20 @@ { "type": "WEB", "url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/940-release-notes" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" } ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T22:26:16Z", "nvd_published_at": "2025-03-10T21:15:40Z" } } \ No newline at end of file