Auto-merge PR#3994

Auto-merge PR#3994

2020/5xxx/CVE-2020-5295.json

@@ -1,18 +1,88 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security-advisories@github.com",
         "ID": "CVE-2020-5295",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "Local File read vulnerability in OctoberCMS"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "october",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": ">= 1.0.319, < 1.0.466"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "octobercms"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466,\nan attacker can exploit this vulnerability to read local files of an October CMS server.\nThe vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.\n\nIssue has been patched in Build 466 (v1.0.466)."
             }
         ]
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "NONE",
+            "baseScore": 4.8,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "LOW",
+            "integrityImpact": "LOW",
+            "privilegesRequired": "HIGH",
+            "scope": "CHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://github.com/octobercms/october/security/advisories/GHSA-r23f-c2j5-rx2f",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/octobercms/october/security/advisories/GHSA-r23f-c2j5-rx2f"
+            },
+            {
+                "name": "https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc",
+                "refsource": "MISC",
+                "url": "https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "GHSA-r23f-c2j5-rx2f",
+        "discovery": "UNKNOWN"
     }
 }