From a44256947e44e87963f030abb56db98e41e7ae43 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Mon, 17 Oct 2022 15:00:47 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2022/3xxx/CVE-2022-3067.json | 90 ++++++++++++++++++++++++++++++++++-- 2022/3xxx/CVE-2022-3552.json | 85 +++------------------------------- 2 files changed, 93 insertions(+), 82 deletions(-) diff --git a/2022/3xxx/CVE-2022-3067.json b/2022/3xxx/CVE-2022-3067.json index 8783917b72d..2b14bd125ae 100644 --- a/2022/3xxx/CVE-2022-3067.json +++ b/2022/3xxx/CVE-2022-3067.json @@ -4,15 +4,97 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2022-3067", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve@gitlab.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "GitLab", + "product": { + "product_data": [ + { + "product_name": "GitLab", + "version": { + "version_data": [ + { + "version_value": ">=15.4, <15.4.1" + }, + { + "version_value": ">=15.3, <15.3.4" + }, + { + "version_value": ">=14.4, <15.2.5" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper access control in GitLab" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://gitlab.com/gitlab-org/gitlab/-/issues/372165", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/372165", + "refsource": "MISC" + }, + { + "name": "https://hackerone.com/reports/1685822", + "url": "https://hackerone.com/reports/1685822", + "refsource": "MISC" + }, + { + "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3067.json", + "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3067.json", + "refsource": "CONFIRM" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID." } ] - } + }, + "impact": { + "cvss": { + "vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "version": "3.1", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" + } + }, + "credit": [ + { + "lang": "eng", + "value": "Thanks [vakzz](https://hackerone.com/vakzz) for reporting this vulnerability through our HackerOne bug bounty program" + } + ] } \ No newline at end of file diff --git a/2022/3xxx/CVE-2022-3552.json b/2022/3xxx/CVE-2022-3552.json index 502c7877c0a..80a91fe342b 100644 --- a/2022/3xxx/CVE-2022-3552.json +++ b/2022/3xxx/CVE-2022-3552.json @@ -1,89 +1,18 @@ { - "CVE_data_meta": { - "ASSIGNER": "security@huntr.dev", - "ID": "CVE-2022-3552", - "STATE": "PUBLIC", - "TITLE": "Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "boxbilling/boxbilling", - "version": { - "version_data": [ - { - "version_affected": "<", - "version_value": "0.0.1" - } - ] - } - } - ] - }, - "vendor_name": "boxbilling" - } - ] - } - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2022-3552", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, "description": { "description_data": [ { "lang": "eng", - "value": "Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1." + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." } ] - }, - "impact": { - "cvss": { - "attackComplexity": "LOW", - "attackVector": "NETWORK", - "availabilityImpact": "HIGH", - "baseScore": 7.2, - "baseSeverity": "HIGH", - "confidentialityImpact": "HIGH", - "integrityImpact": "HIGH", - "privilegesRequired": "HIGH", - "scope": "UNCHANGED", - "userInteraction": "NONE", - "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", - "version": "3.0" - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-434 Unrestricted Upload of File with Dangerous Type" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "name": "https://huntr.dev/bounties/c6e2973d-386d-4667-9426-10d10828539b", - "refsource": "CONFIRM", - "url": "https://huntr.dev/bounties/c6e2973d-386d-4667-9426-10d10828539b" - }, - { - "name": "https://github.com/boxbilling/boxbilling/commit/b6705995785eaa8653e876318c9b3d82060dc945", - "refsource": "MISC", - "url": "https://github.com/boxbilling/boxbilling/commit/b6705995785eaa8653e876318c9b3d82060dc945" - } - ] - }, - "source": { - "advisory": "c6e2973d-386d-4667-9426-10d10828539b", - "discovery": "EXTERNAL" } } \ No newline at end of file