mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
06832b2091
commit
3af3124ef0
@ -1,17 +1,108 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-43950",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, \r\n 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Execute unauthorized code or commands",
|
||||
"cweId": "CWE-601"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiNAC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.4.0",
|
||||
"version_value": "9.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.2.0",
|
||||
"version_value": "9.2.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.1.0",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.8.0",
|
||||
"version_value": "8.8.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.7.0",
|
||||
"version_value": "8.7.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-407",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-407"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiNAC version 9.4.2 or above\r\nPlease upgrade to FortiNAC-F version 7.2.1 or above"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.9,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,112 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-45858",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control",
|
||||
"cweId": "CWE-327"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiNAC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.4.0",
|
||||
"version_value": "9.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.2.0",
|
||||
"version_value": "9.2.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.1.0",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.8.0",
|
||||
"version_value": "8.8.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.7.0",
|
||||
"version_value": "8.7.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-452",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-452"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiNAC-F version 7.2.1 or above\r\nPlease upgrade to FortiNAC version 9.4.2 or above\r\nPlease upgrade to FortiNAC version 9.2.7 or above"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.8,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:R"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,108 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-45859",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control",
|
||||
"cweId": "CWE-522"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiNAC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.4.0",
|
||||
"version_value": "9.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.2.0",
|
||||
"version_value": "9.2.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.1.0",
|
||||
"version_value": "9.1.8"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.8.0",
|
||||
"version_value": "8.8.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.7.0",
|
||||
"version_value": "8.7.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-456",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-456"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiNAC-F version 7.2.1 or above\r\nPlease upgrade to FortiNAC version 9.4.2 or above\r\nPlease upgrade to FortiNAC version 9.2.7 or above\nAfter the upgrade, the CLI account password should be changed.\r\nTo know which accounts require a new password, the following command can be run:\ngrep \":\\$1\" /etc/shadow\nThen, login to the CLI with that user and type \"passwd\" to change the password and update the hash."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.9,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:R"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,108 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-45860",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control",
|
||||
"cweId": "CWE-1390"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiNAC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.4.0",
|
||||
"version_value": "9.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.2.0",
|
||||
"version_value": "9.2.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.1.0",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.8.0",
|
||||
"version_value": "8.8.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.7.0",
|
||||
"version_value": "8.7.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-464",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-464"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiNAC version 9.4.3 or above\r\nPlease upgrade to FortiNAC-F version 7.2.1 or above"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:R"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-4376",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=15.2, <15.9.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.10, <15.10.5"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.11, <15.11.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information exposure in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/385246",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/385246",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1794713",
|
||||
"url": "https://hackerone.com/reports/1794713",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4376.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4376.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 3.0,
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [shells3c](https://hackerone.com/shells3c) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-0756",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "<15.9.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.10, <15.10.5"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.11, <15.11.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper control of generation of code ('code injection') in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/390910",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/390910",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1864278",
|
||||
"url": "https://hackerone.com/reports/1864278",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0756.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0756.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-0805",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=15.2, <15.9.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.10, <15.10.5"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.11, <15.11.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/391433",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/391433",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1850046",
|
||||
"url": "https://hackerone.com/reports/1850046",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0805.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0805.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [albatraoz](https://hackerone.com/albatraoz) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-1178",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=8.6, <15.9.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.10, <15.10.5"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.11, <15.11.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper control of generation of code ('code injection') in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1778009",
|
||||
"url": "https://hackerone.com/reports/1778009",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/381815",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/381815",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 5.7,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,17 +1,108 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-22637",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Execute unauthorized code or commands",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiNAC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.4.0",
|
||||
"version_value": "9.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.2.0",
|
||||
"version_value": "9.2.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.1.0",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.8.0",
|
||||
"version_value": "8.8.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.7.0",
|
||||
"version_value": "8.7.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-23-013",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-23-013"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiNAC-F version 7.2.1 or above\r\nPlease upgrade to FortiNAC version 9.4.3 or above"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.9,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,145 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-22640",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Execute unauthorized code or commands",
|
||||
"cweId": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.2.0",
|
||||
"version_value": "7.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.0.0",
|
||||
"version_value": "7.0.10"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "6.4.0",
|
||||
"version_value": "6.4.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "6.2.0",
|
||||
"version_value": "6.2.13"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "6.0.0",
|
||||
"version_value": "6.0.16"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "FortiProxy",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.2.0",
|
||||
"version_value": "7.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.0.0",
|
||||
"version_value": "7.0.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "2.0.0",
|
||||
"version_value": "2.0.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "1.2.0",
|
||||
"version_value": "1.2.13"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "1.1.0",
|
||||
"version_value": "1.1.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "1.0.0",
|
||||
"version_value": "1.0.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-475",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-475"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.4 or above\r\nPlease upgrade to FortiOS version 7.0.11 or above\r\nPlease upgrade to FortiOS version 6.4.12 or above\r\nPlease upgrade to FortiOS version 6.2.14 or above\r\nPlease upgrade to FortiProxy version 7.2.2 or above\r\nPlease upgrade to FortiProxy version 7.0.8 or above\n\u00a0\nWorkaround:\n\u00a0\nDisable \"Host Check\", \"Restrict to Specific OS Versions\" and \"MAC address host checking\" in sslvpn portal configuration. For example for \"full-access\" sslvpn portal:\n\u00a0\nconfig vpn ssl web portal\r\nedit \"full-access\"\r\nset os-check disable\r\nset host-check none\r\nset mac-addr-check disable\r\nend"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.1,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,112 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-26203",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control",
|
||||
"cweId": "CWE-798"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiNAC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.4.0",
|
||||
"version_value": "9.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.2.0",
|
||||
"version_value": "9.2.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "9.1.0",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.8.0",
|
||||
"version_value": "8.8.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "8.7.0",
|
||||
"version_value": "8.7.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-520",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-520"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiNAC version 9.4.3 or above\r\nPlease upgrade to FortiNAC-F version 7.2.1 or above"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,127 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-27993",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Execute unauthorized code or commands",
|
||||
"cweId": "CWE-23"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiADC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.1.0",
|
||||
"version_value": "7.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.0.0",
|
||||
"version_value": "7.0.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "6.2.0",
|
||||
"version_value": "6.2.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "6.1.0",
|
||||
"version_value": "6.1.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "6.0.0",
|
||||
"version_value": "6.0.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "5.4.0",
|
||||
"version_value": "5.4.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "5.3.0",
|
||||
"version_value": "5.3.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "5.2.0",
|
||||
"version_value": "5.2.8"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-23-069",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-23-069"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiADC version 7.2.1 or above Please upgrade to FortiADC version 7.1.2 or above "
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.7,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:X/RC:C"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,92 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-27999",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@fortinet.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An improper neutralization of special elements used in an OS command vulnerability [CWE-78]\u00a0in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Execute unauthorized code or commands",
|
||||
"cweId": "CWE-78"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Fortinet",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FortiADC",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "7.1.0",
|
||||
"version_value": "7.1.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://fortiguard.com/psirt/FG-IR-22-297",
|
||||
"refsource": "MISC",
|
||||
"name": "https://fortiguard.com/psirt/FG-IR-22-297"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Please upgrade to FortiADC version 7.2.1 or above Please upgrade to FortiADC version 7.1.2 or above "
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.6,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,15 +4,89 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-2182",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=15.10, <15.10.5"
|
||||
},
|
||||
{
|
||||
"version_value": ">=15.11, <15.11.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/403012",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/403012",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 6.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This vulnerability was reported to us by a customer"
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user