diff --git a/2024/0xxx/CVE-2024-0231.json b/2024/0xxx/CVE-2024-0231.json index 3d789433543..db67ba0570e 100644 --- a/2024/0xxx/CVE-2024-0231.json +++ b/2024/0xxx/CVE-2024-0231.json @@ -1,17 +1,109 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0231", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve@gitlab.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-99: Improper Control of Resource Identifiers ('Resource Injection')", + "cweId": "CWE-99" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "GitLab", + "product": { + "product_data": [ + { + "product_name": "GitLab", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "12.0", + "version_value": "17.0.5" + }, + { + "version_affected": "<", + "version_name": "17.1", + "version_value": "17.1.3" + }, + { + "version_affected": "<", + "version_name": "17.2", + "version_value": "17.2.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/437103", + "refsource": "MISC", + "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/437103" + }, + { + "url": "https://hackerone.com/reports/2299337", + "refsource": "MISC", + "name": "https://hackerone.com/reports/2299337" + } + ] + }, + "solution": [ + { + "lang": "en", + "value": "Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above." + } + ], + "credits": [ + { + "lang": "en", + "value": "Thanks [aaron_dewes](https://hackerone.com/aaron_dewes) for reporting this vulnerability through our HackerOne bug bounty program" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 2.7, + "baseSeverity": "LOW" } ] } diff --git a/2024/5xxx/CVE-2024-5067.json b/2024/5xxx/CVE-2024-5067.json index 515c1c3a023..ec00c22cc87 100644 --- a/2024/5xxx/CVE-2024-5067.json +++ b/2024/5xxx/CVE-2024-5067.json @@ -1,17 +1,119 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-5067", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve@gitlab.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", + "cweId": "CWE-200" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "GitLab", + "product": { + "product_data": [ + { + "product_name": "GitLab", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "16.11", + "version_value": "17.0.5" + }, + { + "version_affected": "<", + "version_name": "17.1", + "version_value": "17.1.3" + }, + { + "version_affected": "<", + "version_name": "17.2", + "version_value": "17.2.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504", + "refsource": "MISC", + "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504" + }, + { + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427", + "refsource": "MISC", + "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427" + }, + { + "url": "https://hackerone.com/reports/2462303", + "refsource": "MISC", + "name": "https://hackerone.com/reports/2462303" + }, + { + "url": "https://hackerone.com/reports/2502047", + "refsource": "MISC", + "name": "https://hackerone.com/reports/2502047" + } + ] + }, + "solution": [ + { + "lang": "en", + "value": "Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above." + } + ], + "credits": [ + { + "lang": "en", + "value": "Thanks [yvvdwf](https://hackerone.com/yvvdwf) and [zebraman](https://hackerone.com/zebraman) for reporting this vulnerability through our HackerOne bug bounty program" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 4.4, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/7xxx/CVE-2024-7060.json b/2024/7xxx/CVE-2024-7060.json index ed031bb9ef0..f9171590dfe 100644 --- a/2024/7xxx/CVE-2024-7060.json +++ b/2024/7xxx/CVE-2024-7060.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-7060", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve@gitlab.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", + "cweId": "CWE-200" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "GitLab", + "product": { + "product_data": [ + { + "product_name": "GitLab", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "15.4", + "version_value": "17.0.5" + }, + { + "version_affected": "<", + "version_name": "17.1", + "version_value": "17.1.3" + }, + { + "version_affected": "<", + "version_name": "17.2", + "version_value": "17.2.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/437894", + "refsource": "MISC", + "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/437894" + } + ] + }, + "solution": [ + { + "lang": "en", + "value": "Upgrade to version 17.0.5, 17.1.3, 17.2.1 or higher" + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability has been discovered internally by GitLab team member [Martin Wortschack](https://gitlab.com/wortschi)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 2.6, + "baseSeverity": "LOW" } ] } diff --git a/2024/7xxx/CVE-2024-7091.json b/2024/7xxx/CVE-2024-7091.json index f30658b2ca7..0df29cb52fc 100644 --- a/2024/7xxx/CVE-2024-7091.json +++ b/2024/7xxx/CVE-2024-7091.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-7091", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve@gitlab.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", + "cweId": "CWE-200" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "GitLab", + "product": { + "product_data": [ + { + "product_name": "GitLab", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "15.6", + "version_value": "17.0.5" + }, + { + "version_affected": "<", + "version_name": "17.1", + "version_value": "17.1.3" + }, + { + "version_affected": "<", + "version_name": "17.2", + "version_value": "17.2.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/408469", + "refsource": "MISC", + "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/408469" + } + ] + }, + "solution": [ + { + "lang": "en", + "value": "Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above." + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability was found internally by a GitLab team member [James Nutt](hhttps://gitlab.com/jnutt)." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 4.1, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/7xxx/CVE-2024-7095.json b/2024/7xxx/CVE-2024-7095.json new file mode 100644 index 00000000000..8bd356c3c34 --- /dev/null +++ b/2024/7xxx/CVE-2024-7095.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-7095", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file