diff --git a/2022/2xxx/CVE-2022-2097.json b/2022/2xxx/CVE-2022-2097.json index 5f021070fab..5086a71563e 100644 --- a/2022/2xxx/CVE-2022-2097.json +++ b/2022/2xxx/CVE-2022-2097.json @@ -114,6 +114,11 @@ "refsource": "CONFIRM", "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf" + }, + { + "refsource": "DEBIAN", + "name": "DSA-5343", + "url": "https://www.debian.org/security/2023/dsa-5343" } ] } diff --git a/2022/4xxx/CVE-2022-4345.json b/2022/4xxx/CVE-2022-4345.json index 8cd2ebee47e..2bae1e912c8 100644 --- a/2022/4xxx/CVE-2022-4345.json +++ b/2022/4xxx/CVE-2022-4345.json @@ -56,6 +56,11 @@ "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4345.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4345.json", "refsource": "CONFIRM" + }, + { + "refsource": "MLIST", + "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update", + "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html" } ] }, diff --git a/2023/0xxx/CVE-2023-0411.json b/2023/0xxx/CVE-2023-0411.json index 375d7a65300..5052d28ddc8 100644 --- a/2023/0xxx/CVE-2023-0411.json +++ b/2023/0xxx/CVE-2023-0411.json @@ -71,6 +71,11 @@ "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0411.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0411.json", "refsource": "CONFIRM" + }, + { + "refsource": "MLIST", + "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update", + "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html" } ] }, diff --git a/2023/0xxx/CVE-2023-0412.json b/2023/0xxx/CVE-2023-0412.json index 5c51b0139b2..163234f1b5f 100644 --- a/2023/0xxx/CVE-2023-0412.json +++ b/2023/0xxx/CVE-2023-0412.json @@ -61,6 +61,11 @@ "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0412.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0412.json", "refsource": "CONFIRM" + }, + { + "refsource": "MLIST", + "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update", + "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html" } ] }, diff --git a/2023/0xxx/CVE-2023-0413.json b/2023/0xxx/CVE-2023-0413.json index e247bd2c635..8642813704f 100644 --- a/2023/0xxx/CVE-2023-0413.json +++ b/2023/0xxx/CVE-2023-0413.json @@ -61,6 +61,11 @@ "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0413.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0413.json", "refsource": "CONFIRM" + }, + { + "refsource": "MLIST", + "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update", + "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html" } ] }, diff --git a/2023/0xxx/CVE-2023-0415.json b/2023/0xxx/CVE-2023-0415.json index c1701885722..e7827b59477 100644 --- a/2023/0xxx/CVE-2023-0415.json +++ b/2023/0xxx/CVE-2023-0415.json @@ -61,6 +61,11 @@ "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0415.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0415.json", "refsource": "CONFIRM" + }, + { + "refsource": "MLIST", + "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update", + "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html" } ] }, diff --git a/2023/0xxx/CVE-2023-0417.json b/2023/0xxx/CVE-2023-0417.json index 1205fd3f914..4b51094c9ae 100644 --- a/2023/0xxx/CVE-2023-0417.json +++ b/2023/0xxx/CVE-2023-0417.json @@ -61,6 +61,11 @@ "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0417.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0417.json", "refsource": "CONFIRM" + }, + { + "refsource": "MLIST", + "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3313-1] wireshark security update", + "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html" } ] }, diff --git a/2023/25xxx/CVE-2023-25168.json b/2023/25xxx/CVE-2023-25168.json index 97d51516c47..0a6ae02ab53 100644 --- a/2023/25xxx/CVE-2023-25168.json +++ b/2023/25xxx/CVE-2023-25168.json @@ -1,17 +1,99 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-25168", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing \"server\" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", + "cweId": "CWE-59" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "pterodactyl", + "product": { + "product_data": [ + { + "product_name": "wings", + "version": { + "version_data": [ + { + "version_value": "< 1.7.4", + "version_affected": "=" + }, + { + "version_value": ">= 1.11.0, < 1.11.4", + "version_affected": "=" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5", + "refsource": "MISC", + "name": "https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5" + }, + { + "url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-66p8-j459-rq63", + "refsource": "MISC", + "name": "https://github.com/pterodactyl/wings/security/advisories/GHSA-66p8-j459-rq63" + }, + { + "url": "https://github.com/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d", + "refsource": "MISC", + "name": "https://github.com/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d" + } + ] + }, + "source": { + "advisory": "GHSA-66p8-j459-rq63", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.6, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", + "version": "3.1" } ] }