From 7fe1dc74a52da249494fdf1645de70c97a78f192 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 30 Nov 2023 09:00:31 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2022/45xxx/CVE-2022-45135.json | 69 ++++++++++++++++++++++++++++--- 2023/42xxx/CVE-2023-42502.json | 5 --- 2023/49xxx/CVE-2023-49620.json | 74 +++++++++++++++++++++++++++++++--- 2023/49xxx/CVE-2023-49722.json | 18 +++++++++ 2023/4xxx/CVE-2023-4664.json | 8 ++-- 2023/4xxx/CVE-2023-4702.json | 6 +-- 2023/4xxx/CVE-2023-4972.json | 10 ++--- 2023/5xxx/CVE-2023-5045.json | 6 +-- 2023/5xxx/CVE-2023-5046.json | 6 +-- 2023/6xxx/CVE-2023-6201.json | 2 +- 2023/6xxx/CVE-2023-6400.json | 18 +++++++++ 2023/6xxx/CVE-2023-6401.json | 18 +++++++++ 12 files changed, 206 insertions(+), 34 deletions(-) create mode 100644 2023/49xxx/CVE-2023-49722.json create mode 100644 2023/6xxx/CVE-2023-6400.json create mode 100644 2023/6xxx/CVE-2023-6401.json diff --git a/2022/45xxx/CVE-2022-45135.json b/2022/45xxx/CVE-2022-45135.json index f5f128c149e..2677e3b5f7d 100644 --- a/2022/45xxx/CVE-2022-45135.json +++ b/2022/45xxx/CVE-2022-45135.json @@ -1,18 +1,77 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2022-45135", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@apache.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.\n\nUsers are recommended to upgrade to version 2.3.0, which fixes the issue.\n\n" } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apache Software Foundation", + "product": { + "product_data": [ + { + "product_name": "Apache Cocoon", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "2.2.0", + "version_value": "2.3.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://lists.apache.org/thread/lsvd1hmr2t2q823x21d5ygzgbj9jpvjp", + "refsource": "MISC", + "name": "https://lists.apache.org/thread/lsvd1hmr2t2q823x21d5ygzgbj9jpvjp" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "QSec-Team" + } + ] } \ No newline at end of file diff --git a/2023/42xxx/CVE-2023-42502.json b/2023/42xxx/CVE-2023-42502.json index d76fe7aae62..9eb34a353ab 100644 --- a/2023/42xxx/CVE-2023-42502.json +++ b/2023/42xxx/CVE-2023-42502.json @@ -59,11 +59,6 @@ "url": "https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmn", "refsource": "MISC", "name": "https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmn" - }, - { - "url": "http://www.openwall.com/lists/oss-security/2023/11/28/3", - "refsource": "MISC", - "name": "http://www.openwall.com/lists/oss-security/2023/11/28/3" } ] }, diff --git a/2023/49xxx/CVE-2023-49620.json b/2023/49xxx/CVE-2023-49620.json index 0b9bbe2c4f7..6b307efb068 100644 --- a/2023/49xxx/CVE-2023-49620.json +++ b/2023/49xxx/CVE-2023-49620.json @@ -1,18 +1,82 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-49620", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@apache.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with\u00a0unauthorized\u00a0access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this\u00a0vulnerability" } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-862 Missing Authorization", + "cweId": "CWE-862" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apache Software Foundation", + "product": { + "product_data": [ + { + "product_name": "Apache DolphinScheduler", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "2.0.0", + "version_value": "3.1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/apache/dolphinscheduler/pull/10307", + "refsource": "MISC", + "name": "https://github.com/apache/dolphinscheduler/pull/10307" + }, + { + "url": "https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj", + "refsource": "MISC", + "name": "https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "credits": [ + { + "lang": "en", + "value": "Yuanheng Lab of zhongfu" + } + ] } \ No newline at end of file diff --git a/2023/49xxx/CVE-2023-49722.json b/2023/49xxx/CVE-2023-49722.json new file mode 100644 index 00000000000..562abde2109 --- /dev/null +++ b/2023/49xxx/CVE-2023-49722.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-49722", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/4xxx/CVE-2023-4664.json b/2023/4xxx/CVE-2023-4664.json index 7ac2f2bfffd..67d2c709741 100644 --- a/2023/4xxx/CVE-2023-4664.json +++ b/2023/4xxx/CVE-2023-4664.json @@ -104,15 +104,15 @@ { "attackComplexity": "LOW", "attackVector": "NETWORK", - "availabilityImpact": "NONE", - "baseScore": 7.1, + "availabilityImpact": "HIGH", + "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", - "integrityImpact": "LOW", + "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } ] diff --git a/2023/4xxx/CVE-2023-4702.json b/2023/4xxx/CVE-2023-4702.json index 2412342043c..ea61c12fd8b 100644 --- a/2023/4xxx/CVE-2023-4702.json +++ b/2023/4xxx/CVE-2023-4702.json @@ -83,15 +83,15 @@ { "attackComplexity": "LOW", "attackVector": "NETWORK", - "availabilityImpact": "NONE", - "baseScore": 9.1, + "availabilityImpact": "HIGH", + "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } ] diff --git a/2023/4xxx/CVE-2023-4972.json b/2023/4xxx/CVE-2023-4972.json index 6b5ee6cd491..89b6563a518 100644 --- a/2023/4xxx/CVE-2023-4972.json +++ b/2023/4xxx/CVE-2023-4972.json @@ -82,15 +82,15 @@ { "attackComplexity": "LOW", "attackVector": "NETWORK", - "availabilityImpact": "NONE", - "baseScore": 8.2, - "baseSeverity": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", - "integrityImpact": "LOW", + "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } ] diff --git a/2023/5xxx/CVE-2023-5045.json b/2023/5xxx/CVE-2023-5045.json index 8251cc2756f..70dce66f9fe 100644 --- a/2023/5xxx/CVE-2023-5045.json +++ b/2023/5xxx/CVE-2023-5045.json @@ -84,14 +84,14 @@ "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", - "baseScore": 10, + "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", - "scope": "CHANGED", + "scope": "UNCHANGED", "userInteraction": "NONE", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } ] diff --git a/2023/5xxx/CVE-2023-5046.json b/2023/5xxx/CVE-2023-5046.json index 9fe88fd5bfb..c23b9dba0dd 100644 --- a/2023/5xxx/CVE-2023-5046.json +++ b/2023/5xxx/CVE-2023-5046.json @@ -84,14 +84,14 @@ "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", - "baseScore": 10, + "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", - "scope": "CHANGED", + "scope": "UNCHANGED", "userInteraction": "NONE", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } ] diff --git a/2023/6xxx/CVE-2023-6201.json b/2023/6xxx/CVE-2023-6201.json index b9335e0907e..1f155301eab 100644 --- a/2023/6xxx/CVE-2023-6201.json +++ b/2023/6xxx/CVE-2023-6201.json @@ -75,7 +75,7 @@ "credits": [ { "lang": "en", - "value": "Said Tun\u00e7" + "value": "Said TUNC" } ], "impact": { diff --git a/2023/6xxx/CVE-2023-6400.json b/2023/6xxx/CVE-2023-6400.json new file mode 100644 index 00000000000..a5eacb85214 --- /dev/null +++ b/2023/6xxx/CVE-2023-6400.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-6400", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/6xxx/CVE-2023-6401.json b/2023/6xxx/CVE-2023-6401.json new file mode 100644 index 00000000000..4f229d8c97a --- /dev/null +++ b/2023/6xxx/CVE-2023-6401.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-6401", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file