From feee82a420a12289e4862b23cd6b22435cfb2a54 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 23:14:01 +0000 Subject: [PATCH] Publish Advisories GHSA-7gqc-q9mc-6348 GHSA-39r8-4962-j7vg GHSA-9pvw-8q92-hm9w GHSA-rr3p-5fcf-v5m3 GHSA-3vcr-579j-4x48 GHSA-c7r5-cww9-64q6 --- .../GHSA-7gqc-q9mc-6348.json | 29 +++++++++++--- .../GHSA-39r8-4962-j7vg.json | 29 +++++++++++--- .../GHSA-9pvw-8q92-hm9w.json | 29 +++++++++++--- .../GHSA-rr3p-5fcf-v5m3.json | 32 ++++++++++++--- .../GHSA-3vcr-579j-4x48.json | 36 +++++++++++++---- .../GHSA-c7r5-cww9-64q6.json | 39 +++++++++++++++---- 6 files changed, 160 insertions(+), 34 deletions(-) rename advisories/{unreviewed => github-reviewed}/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json (61%) rename advisories/{unreviewed => github-reviewed}/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json (63%) rename advisories/{unreviewed => github-reviewed}/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json (64%) rename advisories/{unreviewed => github-reviewed}/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json (56%) rename advisories/{unreviewed => github-reviewed}/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json (55%) rename advisories/{unreviewed => github-reviewed}/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json (53%) diff --git a/advisories/unreviewed/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json b/advisories/github-reviewed/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json similarity index 61% rename from advisories/unreviewed/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json rename to advisories/github-reviewed/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json index e993fa7abbe..c27e423d0ca 100644 --- a/advisories/unreviewed/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json +++ b/advisories/github-reviewed/2023/04/GHSA-7gqc-q9mc-6348/GHSA-7gqc-q9mc-6348.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7gqc-q9mc-6348", - "modified": "2023-04-21T18:30:23Z", + "modified": "2024-01-30T23:13:34Z", "published": "2023-04-12T18:30:35Z", "aliases": [ "CVE-2023-30532" ], + "summary": "Lack of authentication mechanism in Jenkins TurboScript Plugin webhook", "details": "A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkinsci.plugins.spoonscript:spoonscript" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.3" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-862" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:13:34Z", "nvd_published_at": "2023-04-12T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json b/advisories/github-reviewed/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json similarity index 63% rename from advisories/unreviewed/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json rename to advisories/github-reviewed/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json index c9ecdc216bb..66c4d267641 100644 --- a/advisories/unreviewed/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json +++ b/advisories/github-reviewed/2023/06/GHSA-39r8-4962-j7vg/GHSA-39r8-4962-j7vg.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-39r8-4962-j7vg", - "modified": "2023-06-23T15:30:41Z", + "modified": "2024-01-30T23:12:41Z", "published": "2023-06-14T15:30:37Z", "aliases": [ "CVE-2023-35144" ], + "summary": "Stored XSS vulnerability in Jenkins Maven Repository Server Plugin", "details": "Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "jenkins:repository" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.10" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:12:41Z", "nvd_published_at": "2023-06-14T13:15:12Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json b/advisories/github-reviewed/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json similarity index 64% rename from advisories/unreviewed/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json rename to advisories/github-reviewed/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json index df02744fbe6..fb621277a0f 100644 --- a/advisories/unreviewed/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json +++ b/advisories/github-reviewed/2023/06/GHSA-9pvw-8q92-hm9w/GHSA-9pvw-8q92-hm9w.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9pvw-8q92-hm9w", - "modified": "2023-06-23T15:30:41Z", + "modified": "2024-01-30T23:12:52Z", "published": "2023-06-14T15:30:37Z", "aliases": [ "CVE-2023-35143" ], + "summary": "Stored XSS vulnerability in Jenkins Maven Repository Server Plugin", "details": "Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control maven project versions in `pom.xml`.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "jenkins:repository" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.10" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:12:52Z", "nvd_published_at": "2023-06-14T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json b/advisories/github-reviewed/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json similarity index 56% rename from advisories/unreviewed/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json rename to advisories/github-reviewed/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json index f257b936e35..699c1d6848b 100644 --- a/advisories/unreviewed/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json +++ b/advisories/github-reviewed/2023/06/GHSA-rr3p-5fcf-v5m3/GHSA-rr3p-5fcf-v5m3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rr3p-5fcf-v5m3", - "modified": "2023-06-23T18:30:21Z", + "modified": "2024-01-30T23:13:05Z", "published": "2023-06-14T15:30:37Z", "aliases": [ "CVE-2023-35142" ], + "summary": "SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin", "details": "Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.checkmarx.jenkins:checkmarx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2023.2.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2022.4.3" + } + } ], "references": [ { @@ -34,9 +56,9 @@ "cwe_ids": [ "CWE-295" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:13:05Z", "nvd_published_at": "2023-06-14T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json b/advisories/github-reviewed/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json similarity index 55% rename from advisories/unreviewed/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json rename to advisories/github-reviewed/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json index c1517a4c3a1..79bb8a5f9f9 100644 --- a/advisories/unreviewed/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json +++ b/advisories/github-reviewed/2023/09/GHSA-3vcr-579j-4x48/GHSA-3vcr-579j-4x48.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-3vcr-579j-4x48", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:11:51Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41940" ], + "summary": "Stored XSS vulnerability in Jenkins TAP Plugin", "details": "Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control TAP file contents.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.tap4j:tap" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.3" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:11:51Z", "nvd_published_at": "2023-09-06T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json b/advisories/github-reviewed/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json similarity index 53% rename from advisories/unreviewed/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json rename to advisories/github-reviewed/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json index 97634a988ad..0f8b190203c 100644 --- a/advisories/unreviewed/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json +++ b/advisories/github-reviewed/2023/09/GHSA-c7r5-cww9-64q6/GHSA-c7r5-cww9-64q6.json @@ -1,17 +1,42 @@ { "schema_version": "1.4.0", "id": "GHSA-c7r5-cww9-64q6", - "modified": "2023-09-06T15:30:26Z", + "modified": "2024-01-30T23:12:08Z", "published": "2023-09-06T15:30:26Z", "aliases": [ "CVE-2023-41930" ], + "summary": "Path traversal in Jenkins Job Configuration History Plugin", "details": "Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:jobConfigHistory" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1229.v3039470161a_d" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1227.v7a" + } + } ], "references": [ { @@ -29,11 +54,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:12:08Z", "nvd_published_at": "2023-09-06T13:15:09Z" } } \ No newline at end of file