Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-10781: Exposure of Resource to Wrong Sphere (CWE-668)
value: In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 9.8
Published: 2020-01-22T14:15Z
Repository: https://github.com/Atinux/schema-inspector
Language: JavaScript
Files changed: lib/schema-inspector.js
Commit date: 2020-01-20 16:01:42 +0100
Commit message: fix: Issue #75
Diff: diff --git a/lib/schema-inspector.js b/lib/schema-inspector.js
index 2bf9d64..3113a61 100644
--- a/lib/schema-inspector.js
+++ b/lib/schema-inspector.js
@@ -78,11 +78,11 @@
 
 		this._schema = schema;
 		this._custom = {};
 		if (custom != null) {
 			for (var key in custom) {
-				if (custom.hasOwnProperty(key)){
+				if (Object.prototype.hasOwnProperty.call(custom, key)) {
 					this._custom['$' + key] = custom[key];
 				}
 			}
 		}
 
@@ -478,11 +478,11 @@
 					this._back();
 				}
 			}
 			else {
 				for (var key in candidate) {
-					if (candidate.hasOwnProperty(key)){
+					if (Object.prototype.hasOwnProperty.call(candidate, key)) {
 						this._deeperArray(key);
 						this._validate(items, candidate[key]);
 						this._back();
 					}
 
@@ -1009,11 +1009,11 @@
 					this._back();
 				}
 			}
 			else {
 				for (i in post) {
-					if(post.hasOwnProperty(i)){
+					if (Object.prototype.hasOwnProperty.call(post, i)) {
 						this._deeperArray(i);
 						post[i] = this._sanitize(schema.items, post[i]);
 						this._back();
 					}
 				}
@@ -1428,11 +1428,11 @@
 		object: function (schema) {
 			var o = {};
 			var prop = schema.properties || {};
 
 			for (var key in prop) {
-				if (prop.hasOwnProperty(key)){
+				if (Object.prototype.hasOwnProperty.call(prop, key)) {
 					if (prop[key].optional === true && _rand.bool() === true) {
 						continue;
 					}
 					if (key !== '*') {
 						o[key] = this.generate(prop[key]);

Vulnerable code: 				if (custom.hasOwnProperty(key)){
					if (candidate.hasOwnProperty(key)){
					if(post.hasOwnProperty(i)){
				if (prop.hasOwnProperty(key)){
Fixed code: 				if (Object.prototype.hasOwnProperty.call(custom, key)) {
					if (Object.prototype.hasOwnProperty.call(candidate, key)) {
					if (Object.prototype.hasOwnProperty.call(post, i)) {
				if (Object.prototype.hasOwnProperty.call(prop, key)) {
CVE-2020-15183: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-09-17T20:15Z
Repository: https://github.com/inunosinsi/soycms
Language: Unknown
Commit date: 2020-09-16 15:54:12 +0900
Commit message: Merge pull request #13 from stypr/xss-patch

Fix Cross-Site Scripting: Print error message instead
CVE-2023-26047: Incomplete Denylist to Cross-Site Scripting (CWE-692)
value: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been patched in version 0.2.0.
CWE description: The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
CVSS v3 base score: 6.1
Published: 2023-03-03T23:15Z
Repository: https://github.com/dwisiswant0/cwa-filter-rules
Language: JSON
Files changed: filters.json
Commit date: 2023-01-12 11:45:45 +0700
Commit message: feat: Added case-insensitivity detects the IE octal/hex/unicode entities

Modified the regular expression rule for handling escape characters by
adding the case-insensitive `(?i)` flag to the rule. This change ensures
that the regular expression will match escape characters regardless of
their case, making the rule more flexible and accommodating a larger
range of possibilities.

Diff: diff --git a/filters.json b/filters.json
index bbf2c40..343c162 100644
--- a/filters.json
+++ b/filters.json
@@ -96,11 +96,11 @@
         },
         "impact":"5"
       },
       {
         "id":"9",
-        "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
+        "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
         "description":"Detects the IE octal, hex and unicode entities",
         "tags":{
           "tag":[
             "xss",
             "csrf"

Vulnerable code:         "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
Fixed code:         "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
CVE-2023-26047: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been patched in version 0.2.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-03T23:15Z
Repository: https://github.com/dwisiswant0/cwa-filter-rules
Language: JSON
Files changed: filters.json
Commit date: 2023-01-12 11:45:45 +0700
Commit message: feat: Added case-insensitivity detects the IE octal/hex/unicode entities

Modified the regular expression rule for handling escape characters by
adding the case-insensitive `(?i)` flag to the rule. This change ensures
that the regular expression will match escape characters regardless of
their case, making the rule more flexible and accommodating a larger
range of possibilities.

Diff: diff --git a/filters.json b/filters.json
index bbf2c40..343c162 100644
--- a/filters.json
+++ b/filters.json
@@ -96,11 +96,11 @@
         },
         "impact":"5"
       },
       {
         "id":"9",
-        "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
+        "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
         "description":"Detects the IE octal, hex and unicode entities",
         "tags":{
           "tag":[
             "xss",
             "csrf"

Vulnerable code:         "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
Fixed code:         "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
CVE-2023-26047: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
value: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been patched in version 0.2.0.
CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CVSS v3 base score: 6.1
Published: 2023-03-03T23:15Z
Repository: https://github.com/dwisiswant0/cwa-filter-rules
Language: JSON
Files changed: filters.json
Commit date: 2023-01-12 11:45:45 +0700
Commit message: feat: Added case-insensitivity detects the IE octal/hex/unicode entities

Modified the regular expression rule for handling escape characters by
adding the case-insensitive `(?i)` flag to the rule. This change ensures
that the regular expression will match escape characters regardless of
their case, making the rule more flexible and accommodating a larger
range of possibilities.

Diff: diff --git a/filters.json b/filters.json
index bbf2c40..343c162 100644
--- a/filters.json
+++ b/filters.json
@@ -96,11 +96,11 @@
         },
         "impact":"5"
       },
       {
         "id":"9",
-        "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
+        "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
         "description":"Detects the IE octal, hex and unicode entities",
         "tags":{
           "tag":[
             "xss",
             "csrf"

Vulnerable code:         "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
Fixed code:         "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
CVE-2013-1428: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-04-26T16:55Z
Repository: https://github.com/gsliepen/tinc
Language: C
Files changed: src/net_packet.c
Commit date: 2013-04-12 17:15:05 +0200
Commit message: Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Normally all requests sent via the meta connections are checked so that they
cannot be larger than the input buffer. However, when packets are forwarded via
meta connections, they are copied into a packet buffer without checking whether
it fits into it. Since the packet buffer is allocated on the stack, this in
effect allows an authenticated remote node to cause a stack overflow.

This issue was found by Martin Schobert.

Diff: diff --git a/src/net_packet.c b/src/net_packet.c
index 1efc60d..054679e 100644
--- a/src/net_packet.c
+++ b/src/net_packet.c
@@ -392,10 +392,13 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 }
 
 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 	vpn_packet_t outpkt;
 
+	if(len > sizeof outpkt.data)
+		return;
+
 	outpkt.len = len;
 	if(c->options & OPTION_TCPONLY)
 		outpkt.priority = 0;
 	else
 		outpkt.priority = -1;

Fixed code: 	if(len > sizeof outpkt.data)
		return;
CVE-2018-20820: Integer Overflow or Wraparound (CWE-190)
value: read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a crafted file.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2019-04-23T14:29Z
Repository: https://github.com/dropbox/lepton
Language: C++
Files changed: src/lepton/jpgcoder.cc
Commit date: 2019-04-09 23:32:33 +0000
Commit message: fix #111

Diff: diff --git a/src/lepton/jpgcoder.cc b/src/lepton/jpgcoder.cc
index da04eb3..4a9e3b0 100644
--- a/src/lepton/jpgcoder.cc
+++ b/src/lepton/jpgcoder.cc
@@ -4161,11 +4161,11 @@ bool read_ujpg( void )
                                       Sirikata::JpegAllocator<uint8_t> >,
                           JpegError> uncompressed_header_buffer(
                               Sirikata::BrotliCodec::Decompress(compressed_header_buffer.data(),
                                                                 compressed_header_buffer.size(),
                                                                 JpegAllocator<uint8_t>(),
-                                                                max_file_size * 2 + 128 * 1024 * 1024));
+                                                                ((size_t)max_file_size) * 2 + 128 * 1024 * 1024));
                 if (uncompressed_header_buffer.second) {
                     always_assert(false && "Data not properly zlib coded");
                     return false;
                 }
                 zlib_hdrs = compressed_header_buffer.size();

Vulnerable code:                                                                 max_file_size * 2 + 128 * 1024 * 1024));
Fixed code:                                                                 ((size_t)max_file_size) * 2 + 128 * 1024 * 1024));
CVE-2024-35219: Insufficient Information (NVD-CWE-noinfo)
value: OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-27T16:15Z
Repository: https://github.com/OpenAPITools/openapi-generator
Language: Java
Files changed: modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java
Commit date: 2024-05-14 11:12:35 +0800
Commit message: skip setting output folder in online service (#18652)


Diff: diff --git a/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java b/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java
index 7cf052e308..be5326278c 100644
--- a/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java
+++ b/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java
@@ -116,18 +116,13 @@ public class Generator {
         }
         if (openapi == null) {
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "The OpenAPI specification supplied was not valid");
         }
 
-        String destPath = null;
-
-        if (opts.getOptions() != null) {
-            destPath = opts.getOptions().get("outputFolder");
-        }
-        if (destPath == null) {
-            destPath = language + "-" + type.getTypeName();
-        }
+        // do not use opts.getOptions().get("outputFolder") as the input can contain ../../
+        // to access other folders in the server
+        String destPath = language + "-" + type.getTypeName();
 
         ClientOptInput clientOptInput = new ClientOptInput();
         String outputFolder = getTmpFolder().getAbsolutePath() + File.separator + destPath;
         String outputFilename = outputFolder + "-bundle.zip";
 

Vulnerable code:         String destPath = null;

        if (opts.getOptions() != null) {
            destPath = opts.getOptions().get("outputFolder");
        }
        if (destPath == null) {
            destPath = language + "-" + type.getTypeName();
        }
Fixed code:         // do not use opts.getOptions().get("outputFolder") as the input can contain ../../
        // to access other folders in the server
        String destPath = language + "-" + type.getTypeName();
CVE-2017-15727: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-22T18:29Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/attachment.php
Commit date: 2017-10-02 15:30:45 +0200
Commit message: Prevent users to upload HTML files as attachments

Diff: diff --git a/phpmyfaq/admin/attachment.php b/phpmyfaq/admin/attachment.php
index 5312273b8..f1fcb0e5b 100644
--- a/phpmyfaq/admin/attachment.php
+++ b/phpmyfaq/admin/attachment.php
@@ -137,11 +137,15 @@ if (!is_null($currentSave) && $currentSave == true && $auth &&
     ?>
 <p>
     <strong><?php echo $PMF_LANG['ad_att_addto'].' '.$PMF_LANG['ad_att_addto_2'] ?></strong>
 </p>
 <?php
-    if (is_uploaded_file($_FILES['userfile']['tmp_name']) && !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize'))) {
+    if (
+        is_uploaded_file($_FILES['userfile']['tmp_name']) &&
+        !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize')) &&
+        $_FILES['userfile']['type'] !== "text/html"
+    ) {
         $att = PMF_Attachment_Factory::create();
         $att->setRecordId($recordId);
         $att->setRecordLang($recordLang);
 
         /*

Vulnerable code:     if (is_uploaded_file($_FILES['userfile']['tmp_name']) && !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize'))) {
Fixed code:     if (
        is_uploaded_file($_FILES['userfile']['tmp_name']) &&
        !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize')) &&
        $_FILES['userfile']['type'] !== "text/html"
    ) {
CVE-2017-15728: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2017-10-22T18:29Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/configuration.php, phpmyfaq/index.php
Commit date: 2017-10-10 16:48:34 +0200
Commit message: Fixed possible admin XSS attack vector

Diff: diff --git a/phpmyfaq/admin/configuration.php b/phpmyfaq/admin/configuration.php
index e376a8002..6a6b69231 100644
--- a/phpmyfaq/admin/configuration.php
+++ b/phpmyfaq/admin/configuration.php
@@ -48,11 +48,12 @@ if ($user->perm->checkRight($user->getUserId(), 'editconfig')) {
         $newConfigValues = [];
         $escapeValues = [
             'main.contactInformations',
             'main.customPdfHeader',
             'main.customPdfFooter',
-            'main.titleFAQ'
+            'main.titleFAQ',
+            'main.metaKeywords'
         ];
 
         // Special checks
         if (isset($editData['edit']['main.enableMarkdownEditor'])) {
             $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWG editor if Markdown is enabled
diff --git a/phpmyfaq/index.php b/phpmyfaq/index.php
index 5aa75d71c..a05f51ba4 100755
--- a/phpmyfaq/index.php
+++ b/phpmyfaq/index.php
@@ -482,12 +482,12 @@ $tplMainPage = array(
     'title' => PMF_String::htmlspecialchars($faqConfig->get('main.titleFAQ').$title),
     'baseHref' => $faqSystem->getSystemUri($faqConfig),
     'version' => $faqConfig->get('main.currentVersion'),
     'header' => PMF_String::htmlspecialchars(str_replace('"', '', $faqConfig->get('main.titleFAQ'))),
     'metaTitle' => PMF_String::htmlspecialchars(str_replace('"', '', $faqConfig->get('main.titleFAQ').$title)),
-    'metaDescription' => $metaDescription,
-    'metaKeywords' => $keywords,
+    'metaDescription' => PMF_String::htmlspecialchars($metaDescription),
+    'metaKeywords' => PMF_String::htmlspecialchars($keywords),
     'metaPublisher' => $faqConfig->get('main.metaPublisher'),
     'metaLanguage' => $PMF_LANG['metaLanguage'],
     'metaCharset' => 'utf-8', // backwards compability
     'metaRobots' => $faqSeo->getMetaRobots($action),
     'phpmyfaqversion' => $faqConfig->get('main.currentVersion'),

Vulnerable code:             'main.titleFAQ'
    'metaDescription' => $metaDescription,
    'metaKeywords' => $keywords,
Fixed code:             'main.titleFAQ',
            'main.metaKeywords'
    'metaDescription' => PMF_String::htmlspecialchars($metaDescription),
    'metaKeywords' => PMF_String::htmlspecialchars($keywords),
CVE-2017-15730: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2017-10-22T18:29Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/stat.ratings.php
Commit date: 2017-09-27 19:31:16 +0200
Commit message: Fixed possible direct calls

Diff: diff --git a/phpmyfaq/admin/stat.ratings.php b/phpmyfaq/admin/stat.ratings.php
index 7ea49fe6f..2874b23d6 100644
--- a/phpmyfaq/admin/stat.ratings.php
+++ b/phpmyfaq/admin/stat.ratings.php
@@ -39,20 +39,29 @@ if ($user->perm->checkRight($user->getUserId(), 'viewlog')) {
             <div class="col-lg-12">
                 <h2 class="page-header">
                     <i aria-hidden="true" class="fa fa-tasks"></i> <?php echo $PMF_LANG['ad_rs'] ?>
 
                     <div class="pull-right">
-                        <a class="btn btn-danger" href="?action=clear-statistics">
+                        <a class="btn btn-danger" 
+                           href="?action=clear-statistics&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
                             <i aria-hidden="true" class="fa fa-trash"></i> <?php echo $PMF_LANG['ad_delete_all_votings'] ?>
                         </a>
                     </div>
                 </h2>
             </div>
         </header>
 
 <?php
-    if ('clear-statistics' === $action) {
+    $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
+
+    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
+        $clearStatistics = false;
+    } else {
+        $clearStatistics = true;
+    }
+
+    if ('clear-statistics' === $action && $clearStatistics) {
         if ($ratings->deleteAll()) {
             echo '<p class="alert alert-success">Statistics successfully deleted.</p>';
         } else {
             echo '<p class="alert alert-danger">Statistics not deleted.</p>';
         }

Vulnerable code:                         <a class="btn btn-danger" href="?action=clear-statistics">
    if ('clear-statistics' === $action) {
Fixed code:                         <a class="btn btn-danger" 
                           href="?action=clear-statistics&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
    $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);

    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
        $clearStatistics = false;
    } else {
        $clearStatistics = true;
    }

    if ('clear-statistics' === $action && $clearStatistics) {
CVE-2017-7579: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-04-07T16:59Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/inc/PMF/Faq.php
Commit date: 2017-03-22 08:46:19 +0100
Commit message: Added missing sanitizing

Diff: diff --git a/phpmyfaq/inc/PMF/Faq.php b/phpmyfaq/inc/PMF/Faq.php
index 35f401cf10..1c7ac24d29 100755
--- a/phpmyfaq/inc/PMF/Faq.php
+++ b/phpmyfaq/inc/PMF/Faq.php
@@ -2135,11 +2135,11 @@ class PMF_Faq
                         continue;
                     }
                 }
 
                 $data['visits'] = (int)$row->visits;
-                $data['question'] = $row->question;
+                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                 $data['date'] = $row->updated;
                 $data['last_visit'] = $row->last_visit;
 
                 $title = $row->question;
                 $url = sprintf(
@@ -2244,11 +2244,11 @@ class PMF_Faq
                         continue;
                     }
                 }
 
                 $data['date'] = $row->updated;
-                $data['question'] = $row->question;
+                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                 $data['answer'] = $row->content;
                 $data['visits'] = $row->visits;
 
                 $title = $row->question;
                 $url = sprintf(
@@ -2258,11 +2258,11 @@ class PMF_Faq
                     $row->category_id,
                     $row->id,
                     $row->lang
                 );
                 $oLink = new PMF_Link($url, $this->_config);
-                $oLink->itemTitle = $row->question;
+                $oLink->itemTitle = $title;
                 $oLink->tooltip = $title;
                 $data['url'] = $oLink->toString();
 
                 $latest[$row->id] = $data;
 

Vulnerable code:                 $data['question'] = $row->question;
                $data['question'] = $row->question;
                $oLink->itemTitle = $row->question;
Fixed code:                 $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                $oLink->itemTitle = $title;
CVE-2024-24574: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-02-05T21:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/attachments.php
Commit date: 2024-01-31 05:40:16 +0100
Commit message: Fixing unsafe render filename on attachments.php

Pathing the unsafe filename rendering that causing the Store XSS on attachments pages
Diff: diff --git a/phpmyfaq/admin/attachments.php b/phpmyfaq/admin/attachments.php
index 961a444d30..e7ffe57e1d 100644
--- a/phpmyfaq/admin/attachments.php
+++ b/phpmyfaq/admin/attachments.php
@@ -19,10 +19,11 @@ use phpMyFAQ\Attachment\AttachmentCollection;
 use phpMyFAQ\Filter;
 use phpMyFAQ\Pagination;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Translation;
 use phpMyFAQ\Utils;
+use phpMyFAQ\Strings;
 use Symfony\Component\HttpFoundation\Request;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
@@ -68,14 +69,14 @@ $pagination = new Pagination(
       </thead>
       <tbody id="attachment-table">
       <?php foreach ($crumbs as $item) : ?>
         <tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>">
           <td><?= $item->id ?></td>
-          <td><?= $item->filename ?></td>
-          <td><?= $item->record_lang ?></td>
+          <td><?= Strings::htmlentities($item->filename); ?></td>
+          <td><?= Strings::htmlentities($item->record_lang); ?></td>
           <td><?= Utils::formatBytes($item->filesize) ?></td>
-          <td><?= $item->mime_type ?></td>
+          <td><?= Strings::htmlentities($item->mime_type); ?></td>
           <td>
             <button class="btn btn-danger btn-delete-attachment" title="<?= Translation::get('ad_gen_delete') ?>"
                     data-attachment-id="<?= $item->id ?>"
                     data-csrf="<?= Token::getInstance()->getTokenString('delete-attachment') ?>">
               <i aria-hidden="true" class="fa fa-trash btn-delete-attachment" data-attachment-id="<?= $item->id ?>"

Vulnerable code:           <td><?= $item->filename ?></td>
          <td><?= $item->record_lang ?></td>
          <td><?= $item->mime_type ?></td>
Fixed code: use phpMyFAQ\Strings;
          <td><?= Strings::htmlentities($item->filename); ?></td>
          <td><?= Strings::htmlentities($item->record_lang); ?></td>
          <td><?= Strings::htmlentities($item->mime_type); ?></td>
CVE-2024-24574: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CVSS v3 base score: 6.1
Published: 2024-02-05T21:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/attachments.php
Commit date: 2024-01-31 05:40:16 +0100
Commit message: Fixing unsafe render filename on attachments.php

Pathing the unsafe filename rendering that causing the Store XSS on attachments pages
Diff: diff --git a/phpmyfaq/admin/attachments.php b/phpmyfaq/admin/attachments.php
index 961a444d30..e7ffe57e1d 100644
--- a/phpmyfaq/admin/attachments.php
+++ b/phpmyfaq/admin/attachments.php
@@ -19,10 +19,11 @@ use phpMyFAQ\Attachment\AttachmentCollection;
 use phpMyFAQ\Filter;
 use phpMyFAQ\Pagination;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Translation;
 use phpMyFAQ\Utils;
+use phpMyFAQ\Strings;
 use Symfony\Component\HttpFoundation\Request;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
@@ -68,14 +69,14 @@ $pagination = new Pagination(
       </thead>
       <tbody id="attachment-table">
       <?php foreach ($crumbs as $item) : ?>
         <tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>">
           <td><?= $item->id ?></td>
-          <td><?= $item->filename ?></td>
-          <td><?= $item->record_lang ?></td>
+          <td><?= Strings::htmlentities($item->filename); ?></td>
+          <td><?= Strings::htmlentities($item->record_lang); ?></td>
           <td><?= Utils::formatBytes($item->filesize) ?></td>
-          <td><?= $item->mime_type ?></td>
+          <td><?= Strings::htmlentities($item->mime_type); ?></td>
           <td>
             <button class="btn btn-danger btn-delete-attachment" title="<?= Translation::get('ad_gen_delete') ?>"
                     data-attachment-id="<?= $item->id ?>"
                     data-csrf="<?= Token::getInstance()->getTokenString('delete-attachment') ?>">
               <i aria-hidden="true" class="fa fa-trash btn-delete-attachment" data-attachment-id="<?= $item->id ?>"

Vulnerable code:           <td><?= $item->filename ?></td>
          <td><?= $item->record_lang ?></td>
          <td><?= $item->mime_type ?></td>
Fixed code: use phpMyFAQ\Strings;
          <td><?= Strings::htmlentities($item->filename); ?></td>
          <td><?= Strings::htmlentities($item->record_lang); ?></td>
          <td><?= Strings::htmlentities($item->mime_type); ?></td>
CVE-2024-27299: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in the  `authorEmail` field which uses PHP's `FILTER_VALIDATE_EMAIL` filter. This filter is insufficient in protecting against SQL injection attacks and should still be properly escaped. However, in this version of phpMyFAQ (3.2.5), this field is not escaped properly can be used together with other fields to fully exploit the SQL injection vulnerability. This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/News.php
Commit date: 2024-03-02 13:42:01 +0100
Commit message: fix: added missing escapting of value

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/News.php b/phpmyfaq/src/phpMyFAQ/News.php
index e96db71dbd..64c802ebfe 100644
--- a/phpmyfaq/src/phpMyFAQ/News.php
+++ b/phpmyfaq/src/phpMyFAQ/News.php
@@ -284,11 +284,11 @@ class News
             $data['date'],
             $data['lang'],
             $this->configuration->getDb()->escape($data['header']),
             $this->configuration->getDb()->escape($data['content']),
             $this->configuration->getDb()->escape($data['authorName']),
-            $data['authorEmail'],
+            $this->configuration->getDb()->escape($data['authorEmail']),
             $data['dateStart'],
             $data['dateEnd'],
             $data['active'],
             $data['comment'],
             $this->configuration->getDb()->escape($data['link']),
@@ -330,11 +330,11 @@ class News
             $data['date'],
             $data['lang'],
             $this->configuration->getDb()->escape($data['header']),
             $this->configuration->getDb()->escape($data['content']),
             $this->configuration->getDb()->escape($data['authorName']),
-            $data['authorEmail'],
+            $this->configuration->getDb()->escape($data['authorEmail']),
             $data['dateStart'],
             $data['dateEnd'],
             $data['active'],
             $data['comment'],
             $this->configuration->getDb()->escape($data['link']),

Vulnerable code:             $data['authorEmail'],
            $data['authorEmail'],
Fixed code:             $this->configuration->getDb()->escape($data['authorEmail']),
            $this->configuration->getDb()->escape($data['authorEmail']),
CVE-2024-28106: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/news.php
Commit date: 2024-03-05 17:27:44 +0100
Commit message: fix: added missing cleanup for news content

Diff: diff --git a/phpmyfaq/news.php b/phpmyfaq/news.php
index 6f210455ba..b9e8c934f3 100644
--- a/phpmyfaq/news.php
+++ b/phpmyfaq/news.php
@@ -22,10 +22,11 @@ use phpMyFAQ\Captcha\Helper\CaptchaHelper;
 use phpMyFAQ\Comments;
 use phpMyFAQ\Date;
 use phpMyFAQ\Entity\CommentType;
 use phpMyFAQ\Filter;
 use phpMyFAQ\Glossary;
+use phpMyFAQ\Helper\FaqHelper;
 use phpMyFAQ\News;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Strings;
 use phpMyFAQ\Translation;
 use Symfony\Component\HttpFoundation\Request;
@@ -68,10 +69,13 @@ $newsHeader = $news['header'];
 // Add Glossary entries
 $oGlossary = new Glossary($faqConfig);
 $newsContent = $oGlossary->insertItemsIntoContent($newsContent ?? '');
 $newsHeader = $oGlossary->insertItemsIntoContent($newsHeader ?? '');
 
+$helper = new FaqHelper($faqConfig);
+$newsContent = $helper->cleanUpContent($newsContent);
+
 // Add an information link if existing
 if (strlen((string) $news['link']) > 0) {
     $newsContent .= sprintf(
         '</p><p>%s<a href="%s" target="%s">%s</a>',
         Translation::get('msgInfo'),

Fixed code: use phpMyFAQ\Helper\FaqHelper;
$helper = new FaqHelper($faqConfig);
$newsContent = $helper->cleanUpContent($newsContent);
CVE-2024-28107: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.  A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Faq.php
Commit date: 2024-03-05 10:51:22 +0100
Commit message: fix: added missing escapting of value

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Faq.php b/phpmyfaq/src/phpMyFAQ/Faq.php
index 343933dedf..ade9895540 100755
--- a/phpmyfaq/src/phpMyFAQ/Faq.php
+++ b/phpmyfaq/src/phpMyFAQ/Faq.php
@@ -923,17 +923,17 @@ class Faq
             $faq->isSticky() ? 1 : 0,
             $this->config->getDb()->escape($faq->getKeywords()),
             $this->config->getDb()->escape($faq->getQuestion()),
             $this->config->getDb()->escape($faq->getAnswer()),
             $this->config->getDb()->escape($faq->getAuthor()),
-            $faq->getEmail(),
+            $this->config->getDb()->escape($faq->getEmail()),
             $faq->isComment() ? 'y' : 'n',
             $faq->getUpdatedDate()->format('YmdHis'),
             '00000000000000',
             '99991231235959',
             date('Y-m-d H:i:s'),
-            $faq->getNotes()
+            $this->config->getDb()->escape($faq->getNotes())
         );
 
         $this->config->getDb()->query($query);
 
         return $faq->getId();
@@ -992,16 +992,16 @@ class Faq
             $faq->isSticky() ? 1 : 0,
             $this->config->getDb()->escape($faq->getKeywords()),
             $this->config->getDb()->escape($faq->getQuestion()),
             $this->config->getDb()->escape($faq->getAnswer()),
             $this->config->getDb()->escape($faq->getAuthor()),
-            $faq->getEmail(),
+            $this->config->getDb()->escape($faq->getEmail()),
             $faq->isComment() ? 'y' : 'n',
             $faq->getUpdatedDate()->format('YmdHis'),
             $faq->getValidFrom()->format('YmdHis'),
             $faq->getValidTo()->format('YmdHis'),
-            $faq->getNotes(),
+            $this->config->getDb()->escape($faq->getNotes()),
             $faq->getId(),
             $faq->getLanguage()
         );
 
         return (bool) $this->config->getDb()->query($query);

Vulnerable code:             $faq->getEmail(),
            $faq->getNotes()
            $faq->getEmail(),
            $faq->getNotes(),
Fixed code:             $this->config->getDb()->escape($faq->getEmail()),
            $this->config->getDb()->escape($faq->getNotes())
            $this->config->getDb()->escape($faq->getEmail()),
            $this->config->getDb()->escape($faq->getNotes()),
CVE-2024-28108: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ._ This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/api.service.php
Commit date: 2024-03-05 10:48:25 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/api.service.php b/phpmyfaq/api.service.php
index d237171c39..28ca2b9c2f 100644
--- a/phpmyfaq/api.service.php
+++ b/phpmyfaq/api.service.php
@@ -410,11 +410,11 @@ switch ($action) {
                 $answer = sprintf(
                     '%s<br><div id="newFAQContentLink">%s<a href="https://%s" target="_blank">%s</a></div>',
                     $answer,
                     Translation::get('msgInfo'),
                     Strings::substr($contentLink, 7),
-                    $contentLink
+                    Strings::htmlentities($contentLink)
                 );
             }
 
             $autoActivate = $faqConfig->get('records.defaultActivation');
 

Vulnerable code:                     $contentLink
Fixed code:                     Strings::htmlentities($contentLink)
CVE-2024-29196: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-26T03:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/configuration.php
Commit date: 2024-03-20 13:29:38 +0100
Commit message: fix: improved check on path

Diff: diff --git a/phpmyfaq/admin/configuration.php b/phpmyfaq/admin/configuration.php
index bfdd704e352..b2b2c18fb42 100644
--- a/phpmyfaq/admin/configuration.php
+++ b/phpmyfaq/admin/configuration.php
@@ -17,10 +17,11 @@
 
 use phpMyFAQ\Filter;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Strings;
 use phpMyFAQ\Translation;
+use Symfony\Component\HttpFoundation\Request;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
 }
@@ -57,15 +58,19 @@ if ($user->perm->hasPermission($user->getUserId(), 'editconfig')) {
         }
         if (isset($editData['edit']['main.currentVersion'])) {
             unset($editData['edit']['main.currentVersion']); // don't update the version number
         }
         if (isset($editData['edit']['records.attachmentsPath'])) {
-            $editData['edit']['records.attachmentsPath'] = str_replace(
-                '../',
-                '',
-                $editData['edit']['records.attachmentsPath']
-            );
+            if (false !== realpath($editData['edit']['records.attachmentsPath'])) {
+                $editData['edit']['records.attachmentsPath'] = str_replace(
+                    Request::createFromGlobals()->server->get('DOCUMENT_ROOT') . DIRECTORY_SEPARATOR,
+                    '',
+                    realpath($editData['edit']['records.attachmentsPath'])
+                );
+            } else {
+                unset($editData['edit']['records.attachmentsPath']);
+            }
         }
 
         if (
             isset($editData['edit']['main.referenceURL']) &&
             is_null(Filter::filterVar($editData['edit']['main.referenceURL'], FILTER_VALIDATE_URL))

Vulnerable code:             $editData['edit']['records.attachmentsPath'] = str_replace(
                '../',
                '',
                $editData['edit']['records.attachmentsPath']
            );
Fixed code: use Symfony\Component\HttpFoundation\Request;
            if (false !== realpath($editData['edit']['records.attachmentsPath'])) {
                $editData['edit']['records.attachmentsPath'] = str_replace(
                    Request::createFromGlobals()->server->get('DOCUMENT_ROOT') . DIRECTORY_SEPARATOR,
                    '',
                    realpath($editData['edit']['records.attachmentsPath'])
                );
            } else {
                unset($editData['edit']['records.attachmentsPath']);
            }
CVE-2020-7964: Missing Authentication for Critical Function (CWE-306)
value: An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 5.3
Published: 2020-01-24T20:15Z
Repository: https://github.com/mirumee/saleor
Language: Unknown
Commit date: 2020-01-23 17:14:14 +0100
Commit message: Merge pull request #5192 from maarcingebala/fix-checkout-attach-user-permissions

Fix permission for checkoutCustomerAttach mutation