Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-21258: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-03-02T20:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: ajax/kanban.php
Commit date: 2021-03-02 09:07:04 +0100
Commit message: Prevent XSS on Kanban

Diff: diff --git a/ajax/kanban.php b/ajax/kanban.php
index 4762eefeeca..cef857558c5 100644
--- a/ajax/kanban.php
+++ b/ajax/kanban.php
@@ -45,10 +45,12 @@ if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    // Get AJAX input and load it into $_REQUEST
    $input = file_get_contents('php://input');
    parse_str($input, $_REQUEST);
 }
 
+$_REQUEST = Toolbox::clean_cross_side_scripting_deep($_REQUEST);
+
 if (!isset($_REQUEST['action'])) {
    Toolbox::logError("Missing action parameter");
    http_response_code(400);
    return;
 }

Fixed code: $_REQUEST = Toolbox::clean_cross_side_scripting_deep($_REQUEST);
CVE-2022-21719: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-28T10:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: ajax/common.tabs.php
Commit date: 2022-01-27 15:33:22 +0100
Commit message: Merge pull request from GHSA-6cj4-g839-gj5j


Diff: diff --git a/ajax/common.tabs.php b/ajax/common.tabs.php
index 86d972ab419..0e5c796f72c 100644
--- a/ajax/common.tabs.php
+++ b/ajax/common.tabs.php
@@ -105,14 +105,10 @@ if (isset($options['locked'])) {
 
 CommonGLPI::displayStandardTab($item, $_UGET['_glpi_tab'], $_GET["withtemplate"], $options);
 
 
 if (isset($_GET['full_page_tab'])) {
-   echo "<div class='center' id='debugajax'>";
-   echo "<a href='".htmlentities($_SERVER['REQUEST_URI'])."' class='vsubmit'>Reload</a>";
-   echo "</div>";
-
    // I think that we should display this warning, because tabs are not prepare
    // for being used full space ...
    if (!isset($_SESSION['glpi_warned_about_full_page_tab'])) {
       // Debug string : not really need translation.
       $msg  = 'WARNING: full page tabs are only for debug/validation purpose !\n';

Vulnerable code:    echo "<div class='center' id='debugajax'>";
   echo "<a href='".htmlentities($_SERVER['REQUEST_URI'])."' class='vsubmit'>Reload</a>";
   echo "</div>";
CVE-2022-21720: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 4.9
Published: 2022-01-28T11:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: front/entity.form.php
Commit date: 2022-01-27 15:32:40 +0100
Commit message: Merge pull request from GHSA-5hg4-r64r-rf83


Diff: diff --git a/front/entity.form.php b/front/entity.form.php
index 190324d8f52..45a044a07a7 100644
--- a/front/entity.form.php
+++ b/front/entity.form.php
@@ -39,9 +39,10 @@ if (isset($_GET['id']) && ($_GET['id'] == 0)) {
    $options = ['canedit' => true,
                     'candel'  => false];
 }
 
 if (array_key_exists('custom_css_code', $_POST)) {
-   $_POST['custom_css_code'] = $_UPOST['custom_css_code'];
+   // Prevent sanitize process to alter '<', '>' and '&' chars.
+   $_POST['custom_css_code'] = $DB->escape($_UPOST['custom_css_code']);
 }
 
 include (GLPI_ROOT . "/front/dropdown.common.form.php");

Vulnerable code:    $_POST['custom_css_code'] = $_UPOST['custom_css_code'];
Fixed code:    // Prevent sanitize process to alter '<', '>' and '&' chars.
   $_POST['custom_css_code'] = $DB->escape($_UPOST['custom_css_code']);
CVE-2022-24867: Insufficiently Protected Credentials (CWE-522)
value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 7.5
Published: 2022-04-21T17:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: src/Config.php
Commit date: 2022-04-20 09:35:15 +0200
Commit message: Do not expose old ldap pass

Diff: diff --git a/src/Config.php b/src/Config.php
index 844aca0284e..f96fc6be4a1 100644
--- a/src/Config.php
+++ b/src/Config.php
@@ -54,11 +54,16 @@ class Config extends CommonDBTM
     public $auto_message_on_action = false;
     public $showdebug              = true;
 
     public static $rightname              = 'config';
 
-    public static $undisclosedFields      = ['proxy_passwd', 'smtp_passwd', 'glpinetwork_registration_key'];
+    public static $undisclosedFields      = [
+        'proxy_passwd',
+        'smtp_passwd',
+        'glpinetwork_registration_key',
+        'ldap_pass', // this one should not exist anymore, but may be present when admin restored config dump after migration
+    ];
     public static $saferUndisclosedFields = ['admin_email', 'replyto_email'];
 
     public static function getTypeName($nb = 0)
     {
         return __('Setup');

Vulnerable code:     public static $undisclosedFields      = ['proxy_passwd', 'smtp_passwd', 'glpinetwork_registration_key'];
Fixed code:     public static $undisclosedFields      = [
        'proxy_passwd',
        'smtp_passwd',
        'glpinetwork_registration_key',
        'ldap_pass', // this one should not exist anymore, but may be present when admin restored config dump after migration
    ];
CVE-2022-24869: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-21T17:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: src/Toolbox.php
Commit date: 2022-04-20 09:40:28 +0200
Commit message: Merge pull request from GHSA-p94c-8qp5-gfpx


Diff: diff --git a/src/Toolbox.php b/src/Toolbox.php
index 9e6b949e6dd..553205a3656 100644
--- a/src/Toolbox.php
+++ b/src/Toolbox.php
@@ -307,11 +307,11 @@ class Toolbox
      * @since 9.5.4
      */
     public static function getHtmLawedSafeConfig(): array
     {
         $config = [
-            'elements'         => '* -applet -canvas -embed -form -object -script',
+            'elements'         => '* -applet -canvas -embed -form -object -script -link',
             'deny_attribute'   => 'on*, srcdoc',
             'comment'          => 1, // 1: remove HTML comments (and do not display their contents)
             'cdata'            => 1, // 1: remove CDATA sections (and do not display their contents)
             'direct_list_nest' => 1, // 1: Allow usage of ul/ol tags nested in other ul/ol tags
             'schemes'          => '*: aim, app, feed, file, ftp, gopher, http, https, irc, mailto, news, nntp, sftp, ssh, tel, telnet, notes'

Vulnerable code:             'elements'         => '* -applet -canvas -embed -form -object -script',
Fixed code:             'elements'         => '* -applet -canvas -embed -form -object -script -link',
CVE-2022-24876: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-09T19:15Z
Repository: https://github.com/glpi-project/glpi
Language: JavaScript
Files changed: js/modules/Kanban/Kanban.js
Commit date: 2022-05-31 10:04:12 +0200
Commit message: Merge pull request from GHSA-33g2-m556-gccr


Diff: diff --git a/js/modules/Kanban/Kanban.js b/js/modules/Kanban/Kanban.js
index 6bebeb5e28e..8cca283414d 100644
--- a/js/modules/Kanban/Kanban.js
+++ b/js/modules/Kanban/Kanban.js
@@ -31,10 +31,11 @@
  * ---------------------------------------------------------------------
  */
 
 import SearchInput from "../SearchTokenizer/SearchInput.js";
 
+/* global escapeMarkupText */
 /* global sortable */
 /* global glpi_toast_error */
 
 /**
  * Kanban rights structure
@@ -2445,11 +2446,11 @@ class GLPIKanbanRights {
                         firstname: l.attr('data-firstname')
                     });
                     l.append(`
                      <div class="member-details">
                         ${member_item}
-                        ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}
+                        ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}
                      </div>
                      <button type="button" name="delete" class="btn btn-ghost-danger">
                         <i class="ti ti-x" title="${__('Delete')}"></i>
                      </button>
                   `);

Vulnerable code:                         ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}
Fixed code: /* global escapeMarkupText */
                        ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}
CVE-2022-31068: Insufficient Information (NVD-CWE-noinfo)
value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2022-06-28T18:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: front/inventory.php
Commit date: 2022-06-28 12:20:43 +0200
Commit message: Merge pull request from GHSA-g4hm-6vfr-q3wg


Diff: diff --git a/front/inventory.php b/front/inventory.php
index 7d8d08dc0df..3788061572d 100644
--- a/front/inventory.php
+++ b/front/inventory.php
@@ -42,10 +42,11 @@ if (!defined('GLPI_ROOT')) {
 $inventory_request = new Request();
 $inventory_request->handleHeaders();
 
 $handle = true;
 if (isset($_GET['refused'])) {
+    Session::checkRight("config", READ);
     $refused = new RefusedEquipment();
     if ($refused->getFromDB($_GET['refused']) && ($inventory_file = $refused->getInventoryFileName()) !== null) {
         $contents = file_get_contents($inventory_file);
     } else {
         trigger_error(

Fixed code:     Session::checkRight("config", READ);
CVE-2023-28633: Server-Side Request Forgery (SSRF) (CWE-918)
value: GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 5.4
Published: 2023-04-05T16:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: CHANGELOG.md, src/RSSFeed.php
Commit date: 2023-04-05 08:11:38 +0200
Commit message: Remove RSS feeds autodiscovery

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index fc209907c599..a12e078ef226 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,10 +20,11 @@ The present file will list all changes made to the project; according to the
 #### Changes
 - Itemtype that can be linked to a disk are now declared in `$CFG_GLPI['disk_types']`.
 
 #### Deprecated
 - `Glpi\Inventory\Conf::importFile()`
+- `RSSFeed::showDiscoveredFeeds()`
 - `Toolbox::checkValidReferer()`
 
 #### Removed
 
 ## [10.0.6] 2023-01-24
diff --git a/src/RSSFeed.php b/src/RSSFeed.php
index 256376347788..74f069e04932 100644
--- a/src/RSSFeed.php
+++ b/src/RSSFeed.php
@@ -788,18 +788,11 @@ class RSSFeed extends CommonDBVisible implements ExtraVisibilityCriteria
             echo sprintf(__('URL "%s" is not allowed by your administrator.'), $this->fields['url']);
         } else {
             echo Dropdown::getYesNo($this->fields['have_error']);
         }
         echo "</td>";
-        if ($this->fields['have_error']) {
-            echo "<td>" . __('RSS feeds found');
-            echo "</td><td>";
-            $this->showDiscoveredFeeds();
-            echo "</td>\n";
-        } else {
-            echo "<td colspan='2'>&nbsp;</td>";
-        }
+        echo "<td colspan='2'>&nbsp;</td>";
         echo "</tr>";
 
         $this->showFormButtons($options);
 
         return true;
@@ -872,13 +865,16 @@ class RSSFeed extends CommonDBVisible implements ExtraVisibilityCriteria
 
     /**
      * Show discovered feeds
      *
      * @return void
+     *
+     * @deprecated
      **/
     public function showDiscoveredFeeds()
     {
+        Toolbox::deprecated();
         if (!Toolbox::isUrlSafe($this->fields['url'])) {
             return;
         }
 
         $feed = new SimplePie();

Vulnerable code:         if ($this->fields['have_error']) {
            echo "<td>" . __('RSS feeds found');
            echo "</td><td>";
            $this->showDiscoveredFeeds();
            echo "</td>\n";
        } else {
            echo "<td colspan='2'>&nbsp;</td>";
        }
Fixed code: - `RSSFeed::showDiscoveredFeeds()`
        echo "<td colspan='2'>&nbsp;</td>";
     *
     * @deprecated
        Toolbox::deprecated();
CVE-2023-43813: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-12-13T19:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: ajax/pin_savedsearches.php
Commit date: 2023-12-13 08:18:01 +0100
Commit message: Merge pull request from GHSA-94c3-fw5r-3362


Diff: diff --git a/ajax/pin_savedsearches.php b/ajax/pin_savedsearches.php
index 86ed5bfbc02c..c43e64c4d3d2 100644
--- a/ajax/pin_savedsearches.php
+++ b/ajax/pin_savedsearches.php
@@ -38,10 +38,15 @@ include('../inc/includes.php');
 header('Content-Type: application/json; charset=UTF-8');
 Html::header_nocache();
 
 Session::checkLoginUser();
 
+if (!is_string($_POST['itemtype']) || getItemForItemtype($_POST['itemtype']) === false) {
+    echo json_encode(['success' => false]);
+    exit();
+}
+
 $all_pinned = importArrayFromDB($_SESSION['glpisavedsearches_pinned']);
 $already_pinned = $all_pinned[$_POST['itemtype']] ?? 0;
 $all_pinned[$_POST['itemtype']] = $already_pinned ? 0 : 1;
 $_SESSION['glpisavedsearches_pinned'] = exportArrayToDB($all_pinned);
 

Fixed code: if (!is_string($_POST['itemtype']) || getItemForItemtype($_POST['itemtype']) === false) {
    echo json_encode(['success' => false]);
    exit();
}
CVE-2023-51446: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2024-02-01T18:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: src/AuthLDAP.php
Commit date: 2024-02-01 09:15:23 +0100
Commit message: Escape user login during LDAP operations

Diff: diff --git a/src/AuthLDAP.php b/src/AuthLDAP.php
index 3c5c3edfa77f..222dd765546d 100644
--- a/src/AuthLDAP.php
+++ b/src/AuthLDAP.php
@@ -3587,10 +3587,12 @@ class AuthLDAP extends CommonDBTM
 
        // Try a search to find the DN
         $filter_value = $values['user_params']['value'];
         if ($values['login_field'] == 'objectguid' && self::isValidGuid($filter_value)) {
             $filter_value = self::guidToHex($filter_value);
+        } else {
+            $filter_value = ldap_escape($filter_value, '', LDAP_ESCAPE_FILTER);
         }
         $filter = "(" . $values['login_field'] . "=" . $filter_value . ")";
 
         if (!empty($values['condition'])) {
             $filter = "(& $filter " . Sanitizer::unsanitize($values['condition']) . ")";

Fixed code:         } else {
            $filter_value = ldap_escape($filter_value, '', LDAP_ESCAPE_FILTER);
CVE-2023-51446: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CWE-90)
value: GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
CWE description: The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2024-02-01T18:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: src/AuthLDAP.php
Commit date: 2024-02-01 09:15:23 +0100
Commit message: Escape user login during LDAP operations

Diff: diff --git a/src/AuthLDAP.php b/src/AuthLDAP.php
index 3c5c3edfa77f..222dd765546d 100644
--- a/src/AuthLDAP.php
+++ b/src/AuthLDAP.php
@@ -3587,10 +3587,12 @@ class AuthLDAP extends CommonDBTM
 
        // Try a search to find the DN
         $filter_value = $values['user_params']['value'];
         if ($values['login_field'] == 'objectguid' && self::isValidGuid($filter_value)) {
             $filter_value = self::guidToHex($filter_value);
+        } else {
+            $filter_value = ldap_escape($filter_value, '', LDAP_ESCAPE_FILTER);
         }
         $filter = "(" . $values['login_field'] . "=" . $filter_value . ")";
 
         if (!empty($values['condition'])) {
             $filter = "(& $filter " . Sanitizer::unsanitize($values['condition']) . ")";

Fixed code:         } else {
            $filter_value = ldap_escape($filter_value, '', LDAP_ESCAPE_FILTER);
CVE-2024-27096: Insufficient Information (NVD-CWE-noinfo)
value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T17:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: src/Search.php
Commit date: 2024-03-13 08:16:02 +0100
Commit message: Merge pull request from GHSA-2x8m-vrcm-2jqv


Diff: diff --git a/src/Search.php b/src/Search.php
index 5411c6539418..62438537ad6f 100644
--- a/src/Search.php
+++ b/src/Search.php
@@ -8023,10 +8023,26 @@ HTML;
                     $_SESSION['glpisearch'][$itemtype][$key] = $val;
                 }
             }
         }
 
+        $int_params = [
+            'sort'
+        ];
+
+        foreach ($params as $key => &$val) {
+            if (in_array($key, $int_params)) {
+                if (is_array($val)) {
+                    foreach ($val as &$subval) {
+                        $subval = (int)$subval;
+                    }
+                } else {
+                    $val = (int)$val;
+                }
+            }
+        }
+
         return $params;
     }
 
 
     /**

Fixed code:         $int_params = [
            'sort'
        ];

        foreach ($params as $key => &$val) {
            if (in_array($key, $int_params)) {
                if (is_array($val)) {
                    foreach ($val as &$subval) {
                        $subval = (int)$subval;
                    }
                } else {
                    $val = (int)$val;
                }
            }
        }
CVE-2024-27104: Insufficient Information (NVD-CWE-noinfo)
value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T17:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: src/Dashboard/Widget.php
Commit date: 2024-03-13 08:16:19 +0100
Commit message: Merge pull request from GHSA-prc3-cx5m-h5mj


Diff: diff --git a/src/Dashboard/Widget.php b/src/Dashboard/Widget.php
index a9745acd9910..880b56330e96 100644
--- a/src/Dashboard/Widget.php
+++ b/src/Dashboard/Widget.php
@@ -1739,16 +1739,18 @@ JAVASCRIPT;
         };
         $md->code_block_content_func = function ($code) {
             return $code;
         };
 
+        $content = RichText::getSafeHtml($md->transform($p['markdown_content']));
+
         $html = <<<HTML
       <div
          class="card markdown"
          style="background-color: {$p['color']}; color: {$fg_color}; border-color: {$border_color}">
 
-         <div class="html_content">{$md->transform($p['markdown_content'])}</div>
+         <div class="html_content">{$content}</div>
          <textarea
             class="markdown_content"
             placeholder="{$ph}">{$p['markdown_content']}</textarea>
 
       </div>

Vulnerable code:          <div class="html_content">{$md->transform($p['markdown_content'])}</div>
Fixed code:         $content = RichText::getSafeHtml($md->transform($p['markdown_content']));

         <div class="html_content">{$content}</div>
CVE-2024-27914: Insufficient Information (NVD-CWE-noinfo)
value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS  vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T17:15Z
Repository: https://github.com/glpi-project/glpi
Language: JavaScript
Files changed: js/modules/Debug/Debug.js
Commit date: 2024-03-13 08:16:31 +0100
Commit message: Merge pull request from GHSA-rcxj-fqr4-q34r


Diff: diff --git a/js/modules/Debug/Debug.js b/js/modules/Debug/Debug.js
index 8c8c523ecd66..f9560359984a 100644
--- a/js/modules/Debug/Debug.js
+++ b/js/modules/Debug/Debug.js
@@ -305,11 +305,11 @@ window.GLPI.Debug = new class Debug {
     cleanSQLQuery(query) {
         const newline_keywords = ['UNION', 'FROM', 'WHERE', 'INNER JOIN', 'LEFT JOIN', 'ORDER BY', 'SORT'];
         const post_newline_keywords = ['UNION'];
         let clean_query = '';
         window.CodeMirror.runMode(query, 'text/x-sql', (text, style) => {
-            text.replace('>', `&gt;`).replace('<', `&lt;`);
+            text = escapeMarkupText(text);
             if (style !== null && style !== undefined) {
                 if (newline_keywords.includes(text.toUpperCase())) {
                     clean_query += '</br>';
                 }
                 clean_query += `<span class="cm-${style.replace(' ', '')}">${text}</span>`;

Vulnerable code:             text.replace('>', `&gt;`).replace('<', `&lt;`);
Fixed code:             text = escapeMarkupText(text);
CVE-2024-31456: Insufficient Information (NVD-CWE-noinfo)
value: GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-07T14:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: ajax/map.php, src/Search.php
Commit date: 2024-04-24 09:21:17 +0200
Commit message: Merge pull request from GHSA-gcj4-2cp3-6h5j


Diff: diff --git a/ajax/map.php b/ajax/map.php
index 3363708076d3..7a987776f400 100644
--- a/ajax/map.php
+++ b/ajax/map.php
@@ -46,11 +46,11 @@ if (!isset($_POST['itemtype']) || !isset($_POST['params'])) {
         'success'   => false,
         'message'   => __('Required argument missing!')
     ];
 } else {
     $itemtype = $_POST['itemtype'];
-    $params   = $_POST['params'];
+    $params = $_POST['params'];
 
     $data = Search::prepareDatasForSearch($itemtype, $params);
     Search::constructSQL($data);
     Search::constructData($data);
 
diff --git a/src/Search.php b/src/Search.php
index 11b5011d9110..fb54d9294436 100644
--- a/src/Search.php
+++ b/src/Search.php
@@ -535,10 +535,12 @@ class Search
 
         if ($p['export_all']) {
             $p['start'] = 0;
         }
 
+        $p = self::cleanParams($p);
+
         $data             = [];
         $data['search']   = $p;
         $data['itemtype'] = $itemtype;
 
        // Instanciate an object to access method
@@ -8031,10 +8033,15 @@ HTML;
                     $_SESSION['glpisearch'][$itemtype][$key] = $val;
                 }
             }
         }
 
+        return self::cleanParams($params);
+    }
+
+    public static function cleanParams(array $params): array
+    {
         $int_params = [
             'sort'
         ];
 
         foreach ($params as $key => &$val) {

Vulnerable code:     $params   = $_POST['params'];
Fixed code:     $params = $_POST['params'];
        $p = self::cleanParams($p);

        return self::cleanParams($params);
    }

    public static function cleanParams(array $params): array
    {
CVE-2022-39228: Observable Discrepancy (CWE-203)
value: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.

CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 6.5
Published: 2023-03-01T17:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2023-02-28 11:45:37 +0100
Commit message: Merge pull request from GHSA-36gx-9q6h-g429

Advisory fix 1 - notify user that his account is locked through email
CVE-2023-22738: Improper Preservation of Permissions (CWE-281)
value: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.
CWE description: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CVSS v3 base score: 6.5
Published: 2023-03-01T21:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2023-02-28 11:40:47 +0100
Commit message: Merge pull request from GHSA-vvjv-97j8-94xh

Remove option to change organization id of an existing user
CVE-2023-23929: Insufficient Session Expiration (CWE-613)
value: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.

CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 8.8
Published: 2023-03-04T00:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2023-02-28 12:04:24 +0100
Commit message: Merge pull request from GHSA-4w59-c3gc-rrhp

Introduce maximum length of refresh tokens
CVE-2023-23930: Deserialization of Untrusted Data (CWE-502)
value: vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.2
Published: 2023-10-11T18:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2023-06-12 11:30:38 +0200
Commit message: Merge pull request from GHSA-5m22-cfq9-86x6

Removing pickle serialization/deserialization
CVE-2023-47631: Insufficient Verification of Data Authenticity (CWE-345)
value: vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 8.8
Published: 2023-11-14T21:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2023-11-14 09:59:17 +0100
Commit message: Merge pull request from GHSA-vc3v-ppc7-v486

Remove lines that skip checking if algorithm is allowed when parent id is set
CVE-2024-21649: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution.  This vulnerability is patched in 4.2.0.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2024-01-30T16:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-01-18 09:35:52 +0100
Commit message: Merge pull request from GHSA-w9h2-px87-74vx

Resolve security advisory for remote code execution within algorithm …
CVE-2024-21653: Other (NVD-CWE-Other)
value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive.  The vulnerability can be mitigated by removing the ssh part from the docker file and rebuilding the docker image.  Version 4.2.0 patches the vulnerability.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2024-01-30T16:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-01-18 09:34:47 +0100
Commit message: Merge pull request from GHSA-2wgc-48g2-cj5w

Delete option to login via SSH into the node/server container
CVE-2024-21671: Observable Discrepancy (CWE-203)
value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks.  Version 4.2.0 patches this vulnerability.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 3.7
Published: 2024-01-30T16:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-01-18 09:36:11 +0100
Commit message: Merge pull request from GHSA-45gq-q4xh-cp53

Fix for username timing attack
CVE-2024-22193: Insecure Storage of Sensitive Information (CWE-922)
value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database.  Users should ensure they set the encryption setting correctly.  This vulnerability is patched in 4.2.0.
CWE description: The product stores sensitive information without properly limiting read or write access by unauthorized actors.
CVSS v3 base score: 4.3
Published: 2024-01-30T16:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-01-18 09:35:19 +0100
Commit message: Merge pull request from GHSA-rjmv-52mp-gjrr

Fix that tasks are not created if the input encryption status does no…
CVE-2024-23823: Insufficient Information (NVD-CWE-noinfo)
value: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.  The impact is limited because v6 does not use session cookies. This issue has been addressed in commit `70bb4e1d8` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-14T19:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-03-07 12:02:46 +0100
Commit message: Merge pull request from GHSA-4946-85pr-fvxh

Implement server configuration option to specification of allowed CORS origins
CVE-2024-24770: Insufficient Information (NVD-CWE-noinfo)
value: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-14T19:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-03-07 12:05:14 +0100
Commit message: Merge pull request from GHSA-5h3x-6gwf-73jm

Password recovery: limit emails & aim for constant-time response
CVE-2024-32969: Insufficient Information (NVD-CWE-noinfo)
value: vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in.  This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-23T09:15Z
Repository: https://github.com/vantage6/vantage6
Language: Unknown
Commit date: 2024-05-22 16:31:52 +0200
Commit message: Merge pull request from GHSA-99r4-cjp4-3hmx

Advisory fix prevent extension permissions collab admin
CVE-2021-32841: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2022-01-26T22:15Z
Repository: https://github.com/icsharpcode/SharpZipLib
Language: C#
Files changed: src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
Commit date: 2021-09-19 08:58:07 +0200
Commit message: fix: specialized tar extract traversal

Diff: diff --git a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
index 4b373fb6..aa482cc0 100644
--- a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
+++ b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
@@ -656,12 +656,13 @@ namespace ICSharpCode.SharpZipLib.Tar
 			}
 
 			name = name.Replace('/', Path.DirectorySeparatorChar);
 
 			string destFile = Path.Combine(destDir, name);
+			var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? "";
 
-			if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
+			if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
 			{
 				throw new InvalidNameException("Parent traversal in paths is not allowed");
 			}
 
 			if (entry.IsDirectory)

Vulnerable code: 			if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
Fixed code: 			var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? "";
			if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
CVE-2019-16370: Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
value: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
CWE description: The product uses a broken or risky cryptographic algorithm or protocol.
CVSS v3 base score: 5.9
Published: 2019-09-16T18:15Z
Repository: https://github.com/gradle/gradle
Language: Unknown
Commit date: 2019-09-16 12:39:44 -0400
Commit message: Merge pull request #10543 from vlsi/sign_hash

signing plugin: use SHA512 instead of SHA1 when signing artifacts
CVE-2022-23630: Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
value: Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled.
CWE description: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CVSS v3 base score: 7.5
Published: 2022-02-10T20:15Z
Repository: https://github.com/gradle/gradle
Language: Unknown
Commit date: 2022-02-02 10:08:54 +0100
Commit message: Merge pull request #19798 Do not share resolvable artifacts between verified and non-verified resolve contexts
CVE-2023-35946: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to write files into an unintended location. The file may be written outside the dependency cache or over another file in the dependency cache. This vulnerability could be used to poison the dependency cache or overwrite important files elsewhere on the filesystem where the Gradle process has write permissions. Exploiting this vulnerability requires an attacker to have control over a dependency repository used by the Gradle build or have the ability to modify the build's configuration. It is unlikely that this would go unnoticed. A fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Gradle will refuse to cache dependencies that have path traversal elements in their dependency coordinates. It is recommended that users upgrade to a patched version. If you are unable to upgrade to Gradle 7.6.2 or 8.2, `dependency verification` will make this vulnerability more difficult to exploit.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2023-06-30T21:15Z
Repository: https://github.com/gradle/gradle
Language: Unknown
Commit date: 2023-06-27 09:32:54 +0200
Commit message: Merge pull request from GHSA-2h6c-rv6q-494v

Fix dependency cache path traversal vulnerability