mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
e0d0f19697
commit
0f0260c186
111
2021/4xxx/CVE-2021-4300.json
Normal file
111
2021/4xxx/CVE-2021-4300.json
Normal file
@ -0,0 +1,111 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2021-4300",
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The name of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "In ghostlander Halcyon wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Betroffen ist die Funktion CBlock::AddToBlockIndex der Datei src/main.cpp der Komponente Block Verification. Mit der Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 1.1.1.0-hal vermag dieses Problem zu l\u00f6sen. Der Patch wird als 0675b25ae9cc10b5fdc8ea3a32c642979762d45e bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-284 Improper Access Controls",
|
||||
"cweId": "CWE-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "ghostlander",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Halcyon",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a",
|
||||
"version_affected": "="
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.217417",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.217417"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.217417",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.217417"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-hal",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-hal"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB GitHub Commit Analyzer"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2021/4xxx/CVE-2021-4301.json
Normal file
18
2021/4xxx/CVE-2021-4301.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2021-4301",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
215
2021/4xxx/CVE-2021-4302.json
Normal file
215
2021/4xxx/CVE-2021-4302.json
Normal file
@ -0,0 +1,215 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2021-4302",
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to address this issue. The name of the patch is b39db9c7ad3800f319195ff0e26a0981395b1c54. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217419."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "Es wurde eine Schwachstelle in slackero phpwcms bis 1.9.26 ausgemacht. Sie wurde als problematisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Komponente SVG File Handler. Durch Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Aktualisieren auf die Version 1.9.27 vermag dieses Problem zu l\u00f6sen. Der Patch wird als b39db9c7ad3800f319195ff0e26a0981395b1c54 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross Site Scripting",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "slackero",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "phpwcms",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "1.9.0",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.1",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.2",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.3",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.4",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.5",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.6",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.7",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.8",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.9",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.10",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.11",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.12",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.13",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.14",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.15",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.16",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.17",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.18",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.19",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.20",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.21",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.22",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.23",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.24",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.25",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": "1.9.26",
|
||||
"version_affected": "="
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.217419",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.217419"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.217419",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.217419"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/slackero/phpwcms/releases/tag/v1.9.27",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/slackero/phpwcms/releases/tag/v1.9.27"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB GitHub Commit Analyzer"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 3.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 3.5,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 4,
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
111
2022/4xxx/CVE-2022-4875.json
Normal file
111
2022/4xxx/CVE-2022-4875.json
Normal file
@ -0,0 +1,111 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-4875",
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "In fossology wurde eine problematische Schwachstelle gefunden. Das betrifft eine unbekannte Funktionalit\u00e4t. Dank der Manipulation des Arguments sql/VarValue mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Patch wird als 8e0eba001662c7eb35f045b70dd458a4643b4553 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross Site Scripting",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "fossology",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a",
|
||||
"version_affected": "="
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.217426",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.217426"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.217426",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.217426"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/fossology/fossology/pull/2356",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/fossology/fossology/pull/2356"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/fossology/fossology/commit/8e0eba001662c7eb35f045b70dd458a4643b4553",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/fossology/fossology/commit/8e0eba001662c7eb35f045b70dd458a4643b4553"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB GitHub Commit Analyzer"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 2.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 2.4,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 3.3,
|
||||
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2023/0xxx/CVE-2023-0055.json
Normal file
18
2023/0xxx/CVE-2023-0055.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-0055",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,108 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-22466",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-665: Improper Initialization",
|
||||
"cweId": "CWE-665"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "tokio-rs",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "tokio",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">= 1.7.0, < 1.18.4",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": ">= 1.19.0, < 1.20.3",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": ">= 1.21.0, < 1.23.1",
|
||||
"version_affected": "="
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/tokio-rs/tokio/pull/5336",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/tokio-rs/tokio/pull/5336"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1"
|
||||
},
|
||||
{
|
||||
"url": "https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients",
|
||||
"refsource": "MISC",
|
||||
"name": "https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-7rrj-xr53-82p7",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.4,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,108 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-22467",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-1333: Inefficient Regular Expression Complexity",
|
||||
"cweId": "CWE-1333"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "moment",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "luxon",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">= 1.0.0, < 1.38.1",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": ">= 2.0.0, < 2.5.2",
|
||||
"version_affected": "="
|
||||
},
|
||||
{
|
||||
"version_value": ">= 3.0.0, < 3.2.1",
|
||||
"version_affected": "="
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/moment/moment/pull/6015#issuecomment-1152961973",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/moment/moment/pull/6015#issuecomment-1152961973"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-3xq5-wjfh-ppjc",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user