netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3g35-v53r-gpxc
GHSA-r4fm-g65h-cr54
GHSA-vm9m-57jr-4pxh
GHSA-3g35-v53r-gpxc
GHSA-r4fm-g65h-cr54
GHSA-vm9m-57jr-4pxh
This commit is contained in:
advisory-database[bot]
2024-02-29 22:51:31 +00:00
parent 5ebae5cbf9
commit fac640a755
6 changed files with 278 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/02/GHSA-3g35-v53r-gpxc/GHSA-3g35-v53r-gpxc.json
+80
View File
@@ -0,0 +1,80 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3g35-v53r-gpxc",
"modified": "2024-02-29T22:49:24Z",
"published": "2024-02-29T12:31:06Z",
"aliases": [
"CVE-2024-1949"
],
"summary": "Mattermost race condition",
"details": "A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.4.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1949"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-02-29T22:49:24Z",
"nvd_published_at": "2024-02-29T11:15:08Z"
}
}
advisories/github-reviewed/2024/02/GHSA-r4fm-g65h-cr54/GHSA-r4fm-g65h-cr54.json
+80
View File
@@ -0,0 +1,80 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4fm-g65h-cr54",
"modified": "2024-02-29T22:49:30Z",
"published": "2024-02-29T12:31:06Z",
"aliases": [
"CVE-2024-1952"
],
"summary": "Mattermost incorrectly allows access individual posts",
"details": "Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.4.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1952"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-02-29T22:49:30Z",
"nvd_published_at": "2024-02-29T11:15:08Z"
}
}
advisories/github-reviewed/2024/02/GHSA-vm9m-57jr-4pxh/GHSA-vm9m-57jr-4pxh.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vm9m-57jr-4pxh",
"modified": "2024-02-29T22:49:33Z",
"published": "2024-02-29T12:31:06Z",
"aliases": [
"CVE-2024-1953"
],
"summary": "Mattermost fails to limit the number of role names",
"details": "Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.3.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1953"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-29T22:49:32Z",
"nvd_published_at": "2024-02-29T11:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-3g35-v53r-gpxc/GHSA-3g35-v53r-gpxc.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3g35-v53r-gpxc",
"modified": "2024-02-29T12:31:06Z",
"published": "2024-02-29T12:31:06Z",
"aliases": [
"CVE-2024-1949"
],
"details": "A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1949"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T11:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-r4fm-g65h-cr54/GHSA-r4fm-g65h-cr54.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4fm-g65h-cr54",
"modified": "2024-02-29T12:31:06Z",
"published": "2024-02-29T12:31:06Z",
"aliases": [
"CVE-2024-1952"
],
"details": "Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1952"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T11:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-vm9m-57jr-4pxh/GHSA-vm9m-57jr-4pxh.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vm9m-57jr-4pxh",
"modified": "2024-02-29T12:31:06Z",
"published": "2024-02-29T12:31:06Z",
"aliases": [
"CVE-2024-1953"
],
"details": "Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1953"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T11:15:08Z"
}
}