Auto-merge PR#3165

Auto-merge PR#3165

2020/5xxx/CVE-2020-5230.json

@@ -1,18 +1,91 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security-advisories@github.com",
         "ID": "CVE-2020-5230",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "Opencast uses unsafe identifiers"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "opencast",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "< 7.6"
+                                        },
+                                        {
+                                            "version_value": ">= 8.0, < 8.1"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "opencast"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and\nelements to be used. This can be problematic for operation and security\nsince such identifiers are sometimes used for file system operations\nwhich may lead to an attacker being able to escape working directories and\nwrite files to other locations.\n\nIn addition, Opencast's Id.toString(…) vs Id.compact(…) behavior,\nthe latter trying to mitigate some of the file system problems, can\ncause errors due to identifier mismatch since an identifier may\nunintentionally change.\n\nThis issue is fixed in Opencast 7.6 and 8.1."
             }
         ]
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "HIGH",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "NONE",
+            "baseScore": 7.7,
+            "baseSeverity": "HIGH",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "LOW",
+            "scope": "CHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-99: Improper Control of Resource Identifiers ('Resource Injection')"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmq",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmq"
+            },
+            {
+                "name": "https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317",
+                "refsource": "MISC",
+                "url": "https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "GHSA-w29m-fjp4-qhmq",
+        "discovery": "UNKNOWN"
     }
-}
+}