From ff135fc0d94fb233346bafa1e7ec77b01459f283 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 23 Sep 2024 19:53:42 +0000
Subject: [PATCH] Publish GHSA-mg8j-w93w-xjgc

---
 .../GHSA-mg8j-w93w-xjgc.json                  | 59 ++++++++++++++++---
 1 file changed, 50 insertions(+), 9 deletions(-)

diff --git a/advisories/github-reviewed/2024/08/GHSA-mg8j-w93w-xjgc/GHSA-mg8j-w93w-xjgc.json b/advisories/github-reviewed/2024/08/GHSA-mg8j-w93w-xjgc/GHSA-mg8j-w93w-xjgc.json
index a5c2dfaede0..077366186a5 100644
--- a/advisories/github-reviewed/2024/08/GHSA-mg8j-w93w-xjgc/GHSA-mg8j-w93w-xjgc.json
+++ b/advisories/github-reviewed/2024/08/GHSA-mg8j-w93w-xjgc/GHSA-mg8j-w93w-xjgc.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mg8j-w93w-xjgc",
-  "modified": "2024-09-03T20:31:27Z",
+  "modified": "2024-09-23T19:52:32Z",
   "published": "2024-08-29T12:31:05Z",
   "aliases": [
     "CVE-2024-45440"
@@ -9,7 +9,14 @@
   "summary": "Drupal Full Path Disclosure",
   "details": "`core/authorize.php` in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of `hash_salt` is `file_get_contents` of a file that does not exist.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -17,8 +24,18 @@
         "ecosystem": "Packagist",
         "name": "drupal/drupal"
       },
-      "versions": [
-        "11.x-dev"
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "last_affected": "11.0.4"
+            }
+          ]
+        }
       ]
     },
     {
@@ -26,8 +43,18 @@
         "ecosystem": "Packagist",
         "name": "drupal/core-recommended"
       },
-      "versions": [
-        "11.x-dev"
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "last_affected": "11.0.4"
+            }
+          ]
+        }
       ]
     },
     {
@@ -35,8 +62,18 @@
         "ecosystem": "Packagist",
         "name": "drupal/core"
       },
-      "versions": [
-        "11.x-dev"
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "last_affected": "11.0.4"
+            }
+          ]
+        }
       ]
     }
   ],
@@ -45,6 +82,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45440"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/github/advisory-database/pull/4827"
+    },
     {
       "type": "WEB",
       "url": "https://senscybersecurity.nl/CVE-2024-45440-Explained"
@@ -58,7 +99,7 @@
     "cwe_ids": [
       "CWE-497"
     ],
-    "severity": "LOW",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-08-29T18:05:46Z",
     "nvd_published_at": "2024-08-29T11:15:27Z"