From 355f77cb0633d4f480b23c9ba21db836eb9e2e75 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Fri, 24 Mar 2023 21:00:35 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/28xxx/CVE-2023-28435.json | 81 ++++++++++++++++++++++++++++++++-- 1 file changed, 77 insertions(+), 4 deletions(-) diff --git a/2023/28xxx/CVE-2023-28435.json b/2023/28xxx/CVE-2023-28435.json index 4defb0891e1..7d86a247d89 100644 --- a/2023/28xxx/CVE-2023-28435.json +++ b/2023/28xxx/CVE-2023-28435.json @@ -1,17 +1,90 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-28435", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "dataease", + "product": { + "product_data": [ + { + "product_name": "dataease", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "< 1.18.5" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc", + "refsource": "MISC", + "name": "https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc" + }, + { + "url": "https://github.com/dataease/dataease/issues/4798", + "refsource": "MISC", + "name": "https://github.com/dataease/dataease/issues/4798" + } + ] + }, + "source": { + "advisory": "GHSA-625h-q3g9-rffc", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", + "version": "3.1" } ] }