From 867863449a45763f1b888ab4a7b113cab339d1a1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 14 Mar 2022 22:47:18 +0000
Subject: [PATCH] Add CVE-2022-24762 for GHSA-4vvg-x86p-mvqc

Add CVE-2022-24762 for GHSA-4vvg-x86p-mvqc
---
 2022/24xxx/CVE-2022-24762.json | 92 +++++++++++++++++++++++++++++++---
 1 file changed, 86 insertions(+), 6 deletions(-)

diff --git a/2022/24xxx/CVE-2022-24762.json b/2022/24xxx/CVE-2022-24762.json
index 40b77c1c492..43310183a92 100644
--- a/2022/24xxx/CVE-2022-24762.json
+++ b/2022/24xxx/CVE-2022-24762.json
@@ -1,18 +1,98 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security-advisories@github.com",
         "ID": "CVE-2022-24762",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "Exposure of Sensitive Information to an Unauthorized Actor in sysend.js"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "sysend.js",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "< 1.10.0"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "jcubic"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages."
             }
         ]
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "NONE",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "NONE",
+            "privilegesRequired": "NONE",
+            "scope": "UNCHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc"
+            },
+            {
+                "name": "https://github.com/jcubic/sysend.js/issues/33",
+                "refsource": "MISC",
+                "url": "https://github.com/jcubic/sysend.js/issues/33"
+            },
+            {
+                "name": "https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a",
+                "refsource": "MISC",
+                "url": "https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a"
+            },
+            {
+                "name": "https://github.com/jcubic/sysend.js/releases/tag/1.10.0",
+                "refsource": "MISC",
+                "url": "https://github.com/jcubic/sysend.js/releases/tag/1.10.0"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "GHSA-4vvg-x86p-mvqc",
+        "discovery": "UNKNOWN"
     }
 }
\ No newline at end of file