From 3ac5d03757d30b9415e89b353f3974b33eea1bb6 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 25 Jul 2024 15:00:45 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/41xxx/CVE-2024-41806.json | 81 ++++++++++++++++++++++++++++++++-- 1 file changed, 77 insertions(+), 4 deletions(-) diff --git a/2024/41xxx/CVE-2024-41806.json b/2024/41xxx/CVE-2024-41806.json index 48b16095e9f..233b5f7b0c6 100644 --- a/2024/41xxx/CVE-2024-41806.json +++ b/2024/41xxx/CVE-2024-41806.json @@ -1,17 +1,90 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-41806", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-284: Improper Access Control", + "cweId": "CWE-284" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "openedx", + "product": { + "product_data": [ + { + "product_name": "edx-platform", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "< cb729a3ced0404736dfa0ae768526c82b608657b" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c", + "refsource": "MISC", + "name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c" + }, + { + "url": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b", + "refsource": "MISC", + "name": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b" + } + ] + }, + "source": { + "advisory": "GHSA-4528-7fh6-x75c", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "version": "3.1" } ] }