diff --git a/advisories/github-reviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json b/advisories/github-reviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json new file mode 100644 index 00000000000..a3044d7592f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-268v-2qq7-84pf", + "modified": "2024-01-30T21:58:23Z", + "published": "2022-05-13T01:18:20Z", + "aliases": [ + "CVE-2017-1000243" + ], + "summary": "Missing permission check in Jenkins Favorite Plugin", + "details": "Jenkins Favorite Plugin up to and including 2.1.0 does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:favorite" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000243" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/favorite-plugin" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2017-06-06/" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/101946" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:58:23Z", + "nvd_published_at": "2017-11-01T13:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json b/advisories/github-reviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json rename to advisories/github-reviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json index 2a57117e14a..861759c6d98 100644 --- a/advisories/unreviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json +++ b/advisories/github-reviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5293-3fgp-cr3x", - "modified": "2022-05-13T01:18:19Z", + "modified": "2024-01-30T21:58:47Z", "published": "2022-05-13T01:18:19Z", "aliases": [ "CVE-2017-1000086" ], + "summary": "Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings", "details": "The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:periodicbackup" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-862" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:58:47Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json b/advisories/github-reviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json rename to advisories/github-reviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json index abc26b2cc4c..6a05feaff99 100644 --- a/advisories/unreviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json +++ b/advisories/github-reviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fhgg-j92h-29rc", - "modified": "2022-05-13T01:25:16Z", + "modified": "2024-01-30T21:59:05Z", "published": "2022-05-13T01:25:16Z", "aliases": [ "CVE-2019-1003091" ], + "summary": "Missing permission check in Jenkins SOASTA CloudTest Plugin", "details": "A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.soasta.jenkins:cloudtest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.25" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:59:05Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json b/advisories/unreviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json deleted file mode 100644 index ddc016554f2..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-268v-2qq7-84pf", - "modified": "2022-05-13T01:18:20Z", - "published": "2022-05-13T01:18:20Z", - "aliases": [ - "CVE-2017-1000243" - ], - "details": "Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000243" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2017-06-06/" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/101946" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-862" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-11-01T13:29:00Z" - } -} \ No newline at end of file