Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update 20240109071547 #289

Merged
merged 1 commit into from
Jan 9, 2024
Merged

Update 20240109071547 #289

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions data/mattermost/BIT-mattermost-2023-47858.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
{
"schema_version": "1.5.0",
"id": "BIT-mattermost-2023-47858",
"details": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.",
"aliases": [
"CVE-2023-47858"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mattermost",
"purl": "pkg:bitnami/mattermost"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.7"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.5"
},
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.4"
},
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.3"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"published": "2024-01-09T07:23:23.374Z",
"modified": "2024-01-09T07:46:05.780Z"
}
50 changes: 50 additions & 0 deletions data/mattermost/BIT-mattermost-2023-48732.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
{
"schema_version": "1.5.0",
"id": "BIT-mattermost-2023-48732",
"details": "Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.",
"aliases": [
"CVE-2023-48732"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mattermost",
"purl": "pkg:bitnami/mattermost"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.7"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"published": "2024-01-09T07:23:12.991Z",
"modified": "2024-01-09T07:46:05.780Z"
}
50 changes: 50 additions & 0 deletions data/mattermost/BIT-mattermost-2023-50333.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
{
"schema_version": "1.5.0",
"id": "BIT-mattermost-2023-50333",
"details": "Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.",
"aliases": [
"CVE-2023-50333"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mattermost",
"purl": "pkg:bitnami/mattermost"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.7"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"published": "2024-01-09T07:22:35.478Z",
"modified": "2024-01-09T07:46:05.780Z"
}
64 changes: 64 additions & 0 deletions data/prestashop/BIT-prestashop-2024-21627.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
{
"schema_version": "1.5.0",
"id": "BIT-prestashop-2024-21627",
"details": "PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.",
"aliases": [
"CVE-2024-21627"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "prestashop",
"purl": "pkg:bitnami/prestashop"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.8.11"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.1.3"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/commit/73cfb44666818eefd501b526a894fe884dd12129"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/commit/ba06d18466df5b92cb841d504cc7210121104883"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq"
}
],
"published": "2024-01-09T07:27:08.591Z",
"modified": "2024-01-09T07:46:05.780Z"
}
54 changes: 54 additions & 0 deletions data/prestashop/BIT-prestashop-2024-21628.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
{
"schema_version": "1.5.0",
"id": "BIT-prestashop-2024-21628",
"details": "PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.",
"aliases": [
"CVE-2024-21628"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "prestashop",
"purl": "pkg:bitnami/prestashop"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.3"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf"
}
],
"published": "2024-01-09T07:27:00.090Z",
"modified": "2024-01-09T07:46:05.780Z"
}
6 changes: 3 additions & 3 deletions data/sqlite/BIT-sqlite-2023-7104.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"ranges": [
Expand All @@ -34,7 +34,7 @@
}
],
"database_specific": {
"severity": "Critical",
"severity": "High",
"cpes": [
"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"
]
Expand Down Expand Up @@ -66,5 +66,5 @@
}
],
"published": "2024-01-06T07:29:11.558Z",
"modified": "2024-01-08T07:45:08.305Z"
"modified": "2024-01-09T07:46:05.780Z"
}