Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-20162: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 5.3
Published: 2023-01-05T12:15Z
Repository: https://github.com/vercel/ms
Language: JavaScript
Files changed: index.js
Commit date: 2017-05-16 11:08:29 +0200
Commit message: Limit str to 100 to avoid ReDoS of 0.3s (#89)


Diff: diff --git a/index.js b/index.js
index 8d79c47..6a522b1 100644
--- a/index.js
+++ b/index.js
@@ -44,11 +44,11 @@ module.exports = function(val, options) {
  * @api private
  */
 
 function parse(str) {
   str = String(str);
-  if (str.length > 10000) {
+  if (str.length > 100) {
     return;
   }
   var match = /^((?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|years?|yrs?|y)?$/i.exec(
     str
   );

Vulnerable code:   if (str.length > 10000) {
Fixed code:   if (str.length > 100) {
CVE-2018-13423: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-07-07T17:29Z
Repository: https://github.com/omeka/Omeka
Language: PHP
Files changed: admin/themes/default/items/tag-form.php, admin/themes/default/javascripts/items.js
Commit date: 2018-04-24 16:03:22 -0400
Commit message: Add escaping for tags on item form

Diff: diff --git a/admin/themes/default/items/tag-form.php b/admin/themes/default/items/tag-form.php
index 399c4f606..6fce6612f 100644
--- a/admin/themes/default/items/tag-form.php
+++ b/admin/themes/default/items/tag-form.php
@@ -16,11 +16,11 @@
         
         <div class="tag-list">
         <ul id="all-tags-list">
             <?php foreach( $tags as $tag ): ?>
                 <li>
-                    <?php echo '<span class="tag">' . $tag->name . '</span>'; 
+                    <?php echo '<span class="tag">' . html_escape($tag->name) . '</span>';
                           echo '<span class="undo-remove-tag"><a href="#">' . __('Undo') . '</a></span>';
                           echo '<span class="remove-tag"><a href="#">' . __('Remove') . '</a></span>'; ?>
                 </li>
             <?php endforeach; ?>
         </ul>
diff --git a/admin/themes/default/javascripts/items.js b/admin/themes/default/javascripts/items.js
index 16332d593..806f1dcdf 100644
--- a/admin/themes/default/javascripts/items.js
+++ b/admin/themes/default/javascripts/items.js
@@ -100,11 +100,11 @@ Omeka.Items = {};
         var tagLi = $('<li/>');
         tagLi.after(" ");
 
         var undoButton = $('<span class="undo-remove-tag"><a href="#">Undo</a></span>').appendTo(tagLi);
         var deleteButton = $('<span class="remove-tag"><a href="#">Remove</a></span>').appendTo(tagLi);
-        tagLi.prepend('<span class="tag">' + tag + '</span>');
+        $('<span></span>', {'class': 'tag', 'text': tag}).appendTo(tagLi);
 
         if($('#all-tags-list').length != 0) {
             $('#all-tags-list').append(tagLi);
         } else {
             $('#all-tags').append($('<h3>All Tags</h3><div class="tag-list"><ul id="all-tags-list"></ul></div>'));

Vulnerable code:                     <?php echo '<span class="tag">' . $tag->name . '</span>'; 
        tagLi.prepend('<span class="tag">' + tag + '</span>');
Fixed code:                     <?php echo '<span class="tag">' . html_escape($tag->name) . '</span>';
        $('<span></span>', {'class': 'tag', 'text': tag}).appendTo(tagLi);
CVE-2021-26799: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-07-23T11:15Z
Repository: https://github.com/omeka/Omeka
Language: PHP
Files changed: application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
Commit date: 2021-02-03 13:27:12 -0500
Commit message: Apply HTML filtering to files form

(fix #935)

Diff: diff --git a/application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php b/application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
index cb0ce85f3..322e36a23 100644
--- a/application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
+++ b/application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
@@ -104,10 +104,28 @@ class Omeka_Controller_Plugin_HtmlPurifier extends Zend_Controller_Plugin_Abstra
         $post = $this->_filterElementsFromPost($post, $htmlPurifierFilter);
 
         $request->setPost($post);
     }
 
+    /**
+     * Filter the Files form post, including the 'Elements' array of the POST.
+     *
+     * @param Zend_Controller_Request_Abstract $request
+     * @param Omeka_Filter_HtmlPurifier $htmlPurifierFilter
+     **/
+    public function filterFilesForm($request, $htmlPurifierFilter = null)
+    {
+        if ($htmlPurifierFilter === null) {
+            $htmlPurifierFilter = new Omeka_Filter_HtmlPurifier();
+        }
+
+        $post = $request->getPost();
+        $post = $this->_filterElementsFromPost($post, $htmlPurifierFilter);
+
+        $request->setPost($post);
+    }
+
     /**
      * Purify all of the data in the theme settings
      *
      * @param Zend_Controller_Request_Abstract $request
      * @param Omeka_Filter_HtmlPurifier $htmlPurifierFilter

Fixed code:     /**
     * Filter the Files form post, including the 'Elements' array of the POST.
     *
     * @param Zend_Controller_Request_Abstract $request
     * @param Omeka_Filter_HtmlPurifier $htmlPurifierFilter
     **/
    public function filterFilesForm($request, $htmlPurifierFilter = null)
    {
        if ($htmlPurifierFilter === null) {
            $htmlPurifierFilter = new Omeka_Filter_HtmlPurifier();
        }

        $post = $request->getPost();
        $post = $this->_filterElementsFromPost($post, $htmlPurifierFilter);

        $request->setPost($post);
    }
CVE-2015-10103: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 5.5
Published: 2023-04-17T19:15Z
Repository: https://github.com/InternalError503/forget-it
Language: JavaScript
Files changed: js/settings.js
Commit date: 2015-10-12 00:13:46 +1000
Commit message: Fixed: denial of service loop if setForgetTime set to 0.

A small issue with setForgetTime input field would allow users to
manually enter 0 value in the input and save it causing the timed forget
loop to rapidly refresh causing a denial of service.

Diff: diff --git a/js/settings.js b/js/settings.js
index c75abb4..854a672 100644
--- a/js/settings.js
+++ b/js/settings.js
@@ -85,23 +85,31 @@
 	            }
                 chrome.browserAction.setBadgeText({
                     text: ""
                 });
 	        });
-
+			
+			//Important: setForgetTime can't be less then 1 minute (denial of service loop)
+			$('#setForgetTime').change(function() {
+				if(document.getElementById('setForgetTime').value > 0){
+					forgetitoptions.forget_save_options();
+				}else{
+					document.getElementById('setForgetTime').value = 1;
+				}	
+			});
+			
 	        //Save settings as they are changed.	
 	        $("#enableConfirmData, \
 			#clearDataFrom, \
 			#dataAppCache, #dataCache, \
 			#dataCookies, #dataDownloads, \
 			#dataFileSystems, #dataFormData, \
 			#dataHistory, #dataIndexedDB, \
 			#dataLocalStorage, #dataPluginData, \
 			#dataPasswords, #dataWebSQL, \
 			#enableTimedForget, #timedForgetHour, \
-			#timedForgetMinute, #timedForgetTime, \
-			#setForgetTime").change(function() {
+			#timedForgetMinute, #timedForgetTime").change(function() {
 	            forgetitoptions.forget_save_options();
 	        });
 			
 			//Select|Deselect buttons
 			$('#sAll').click(function(){

Vulnerable code: 
			#timedForgetMinute, #timedForgetTime, \
			#setForgetTime").change(function() {
Fixed code: 			
			//Important: setForgetTime can't be less then 1 minute (denial of service loop)
			$('#setForgetTime').change(function() {
				if(document.getElementById('setForgetTime').value > 0){
					forgetitoptions.forget_save_options();
				}else{
					document.getElementById('setForgetTime').value = 1;
				}	
			});
			
			#timedForgetMinute, #timedForgetTime").change(function() {
CVE-2015-3886: Improper Certificate Validation (CWE-295)
value: libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 9.8
Published: 2017-07-21T14:29Z
Repository: https://github.com/gobby/libinfinity
Language: C
Files changed: libinfgtk/inf-gtk-certificate-manager.c
Commit date: 2015-05-11 23:03:51 -0400
Commit message: Fix expired certificate validation (gobby #61)

Diff: diff --git a/libinfgtk/inf-gtk-certificate-manager.c b/libinfgtk/inf-gtk-certificate-manager.c
index ace4333..cd36632 100644
--- a/libinfgtk/inf-gtk-certificate-manager.c
+++ b/libinfgtk/inf-gtk-certificate-manager.c
@@ -707,13 +707,15 @@ inf_gtk_certificate_manager_certificate_func(InfXmppConnection* connection,
         &verify
       );
 
       if(ret != GNUTLS_E_SUCCESS)
         inf_gnutls_set_error(&error, ret);
-      else if(verify & GNUTLS_CERT_INVALID)
-        inf_gnutls_certificate_verification_set_error(&error, verify);
     }
+
+    if(error == NULL)
+      if(verify & GNUTLS_CERT_INVALID)
+        inf_gnutls_certificate_verification_set_error(&error, verify);
   }
 
   /* Look up the host in our database of pinned certificates if we could not
    * fully verify the certificate, i.e. if either the issuer is not known or
    * the hostname of the connection does not match the certificate. */

Vulnerable code:       else if(verify & GNUTLS_CERT_INVALID)
        inf_gnutls_certificate_verification_set_error(&error, verify);
Fixed code: 
    if(error == NULL)
      if(verify & GNUTLS_CERT_INVALID)
        inf_gnutls_certificate_verification_set_error(&error, verify);
CVE-2019-12742: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 8.8
Published: 2019-06-05T16:29Z
Repository: https://github.com/bludit/bludit
Language: PHP
Files changed: bl-kernel/admin/controllers/user-password.php
Commit date: 2019-05-28 20:49:29 +0200
Commit message: Prevent non-administrators to change the password from other users

Diff: diff --git a/bl-kernel/admin/controllers/user-password.php b/bl-kernel/admin/controllers/user-password.php
index 0f86abb7..8a7e8c9d 100644
--- a/bl-kernel/admin/controllers/user-password.php
+++ b/bl-kernel/admin/controllers/user-password.php
@@ -11,12 +11,18 @@
 // ============================================================================
 // POST Method
 // ============================================================================
 
 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+	// Prevent non-administrators to change other users
+	$username = $_POST['username'];
+	if ($login->role()!=='admin') {
+	    $username = $login->username();
+	}
+
 	if (changeUserPassword(array(
-		'username'=>$_POST['username'],
+		'username'=>$username,
 		'newPassword'=>$_POST['newPassword'],
 		'confirmPassword'=>$_POST['confirmPassword']
 	))) {
 		if ($login->role()==='admin') {
 			Redirect::page('users');

Vulnerable code: 		'username'=>$_POST['username'],
Fixed code: 	// Prevent non-administrators to change other users
	$username = $_POST['username'];
	if ($login->role()!=='admin') {
	    $username = $login->username();
	}

		'username'=>$username,
CVE-2023-45827: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2023-11-06T18:15Z
Repository: https://github.com/clickbar/dot-diver
Language: Unknown
Commit date: 2023-11-02 23:41:08 +0100
Commit message: Merge pull request #12 from clickbar/fix/prototype-pollution

Add guards against prototype pollution
CVE-2023-2675: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 9.8
Published: 2023-11-07T04:13Z
Repository: https://github.com/linagora/twake
Language: TypeScript
Files changed: twake/backend/node/src/services/console/clients/remote.ts
Commit date: 2023-04-05 18:12:40 +0000
Commit message: 🩹 Patch 4 - Fix guest invitation with new console documentation (#2791)


Diff: diff --git a/twake/backend/node/src/services/console/clients/remote.ts b/twake/backend/node/src/services/console/clients/remote.ts
index 14e8ab06d..ec0ffbf73 100644
--- a/twake/backend/node/src/services/console/clients/remote.ts
+++ b/twake/backend/node/src/services/console/clients/remote.ts
@@ -55,19 +55,32 @@ export class ConsoleRemoteClient implements ConsoleServiceClient {
       };
     }
 
     if (user.skipInvite && user.name && user.email && user.password) {
       return this.client
-        .post(`/api/companies/${company.code}/users`, user, {
-          auth: this.auth(),
-          headers: {
-            "Content-Type": "application/json",
+        .post(
+          `/api/companies/${company.code}/users`,
+          {
+            ...user,
+            ...(isNewConsole
+              ? {
+                  name: user.lastName ? user.firstName : user.name,
+                  surname: user.lastName,
+                  applicationCodes: ["twake"],
+                }
+              : {}),
           },
-          params: {
-            skipInvite: user.skipInvite,
+          {
+            auth: this.auth(),
+            headers: {
+              "Content-Type": "application/json",
+            },
+            params: {
+              skipInvite: user.skipInvite,
+            },
           },
-        })
+        )
         .then(({ data }) => data);
     } else {
       const invitationData = {
         role: user.role,
         emails: [

Vulnerable code:         .post(`/api/companies/${company.code}/users`, user, {
          auth: this.auth(),
          headers: {
            "Content-Type": "application/json",
          params: {
            skipInvite: user.skipInvite,
        })
Fixed code:         .post(
          `/api/companies/${company.code}/users`,
          {
            ...user,
            ...(isNewConsole
              ? {
                  name: user.lastName ? user.firstName : user.name,
                  surname: user.lastName,
                  applicationCodes: ["twake"],
                }
              : {}),
          {
            auth: this.auth(),
            headers: {
              "Content-Type": "application/json",
            },
            params: {
              skipInvite: user.skipInvite,
            },
        )
CVE-2022-0437: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-05T02:15Z
Repository: https://github.com/karma-runner/karma
Language: JavaScript
Files changed: client/karma.js, static/karma.js
Commit date: 2022-02-01 03:45:28 -0600
Commit message: fix(security): remove XSS vulnerability in `returnUrl` query param

The `returnUrl` query parameter can be used to execute malicious code. For
example, visiting
`http://localhost:9876/?return_url=javascript:alert(document.domain)` will
display an alert.

Diff: diff --git a/client/karma.js b/client/karma.js
index 64264d1..b5a6f76 100644
--- a/client/karma.js
+++ b/client/karma.js
@@ -237,10 +237,13 @@ function Karma (updater, socket, iframe, opener, navigator, location, document)
       navigateContextTo('about:blank')
     } else {
       self.updater.updateTestStatus('complete')
     }
     if (returnUrl) {
+      if (!/^https?:\/\//.test(returnUrl)) {
+        throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`)
+      }
       location.href = returnUrl
     }
   }
 
   this.info = function (info) {
diff --git a/static/karma.js b/static/karma.js
index b880018..7d7e49a 100644
--- a/static/karma.js
+++ b/static/karma.js
@@ -247,10 +247,13 @@ function Karma (updater, socket, iframe, opener, navigator, location, document)
       navigateContextTo('about:blank')
     } else {
       self.updater.updateTestStatus('complete')
     }
     if (returnUrl) {
+      if (!/^https?:\/\//.test(returnUrl)) {
+        throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`)
+      }
       location.href = returnUrl
     }
   }
 
   this.info = function (info) {

Fixed code:       if (!/^https?:\/\//.test(returnUrl)) {
        throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`)
      }
      if (!/^https?:\/\//.test(returnUrl)) {
        throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`)
      }
CVE-2022-21681: Inefficient Regular Expression Complexity (CWE-1333)
value: Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-01-14T17:15Z
Repository: https://github.com/markedjs/marked
Language: Unknown
Commit date: 2022-01-12 20:01:19 -0600
Commit message: fix(security): fix redos vulnerabilities
CVE-2021-39180: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user (e.g. the tomcat user). Depending on the configuration this can be limited to files of the OpenOlat user data directory, however, if not properly set up, the attack could also be used to overwrite application server config files, java code or even operating system files. The attack could be used to corrupt or modify any OpenOlat file such as course structures, config files or temporary test data. Those attack would require in-depth knowledge of the installation and thus more theoretical. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is know, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3 and 16.0.0. There are no known workarounds aside from upgrading.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2021-08-31T18:15Z
Repository: https://github.com/OpenOLAT/OpenOLAT
Language: Java
Files changed: src/test/java/org/olat/modules/wiki/WikiManagerTest.java
Commit date: 2021-07-02 09:04:25 +0200
Commit message: OO-5549: replace the wildfly assert by a junit one
Diff: diff --git a/src/test/java/org/olat/modules/wiki/WikiManagerTest.java b/src/test/java/org/olat/modules/wiki/WikiManagerTest.java
index 612f7cced4..1a277d1de2 100644
--- a/src/test/java/org/olat/modules/wiki/WikiManagerTest.java
+++ b/src/test/java/org/olat/modules/wiki/WikiManagerTest.java
@@ -22,19 +22,19 @@ package org.olat.modules.wiki;
 import java.io.File;
 import java.net.URISyntaxException;
 import java.net.URL;
 
 import org.junit.After;
+import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.olat.core.logging.OLATRuntimeException;
 import org.olat.core.util.CodeHelper;
 import org.olat.core.util.FileUtils;
 import org.olat.core.util.WebappHelper;
 import org.olat.test.OlatTestCase;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.wildfly.common.Assert;
 
 /**
  * 
  * Initial date: 22 juin 2021<br>
  * @author srosse, stephane.rosse@frentix.com, http://www.frentix.com

Vulnerable code: import org.wildfly.common.Assert;
Fixed code: import org.junit.Assert;
CVE-2024-28198: Insufficient Information (NVD-CWE-noinfo)
value: OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-11T20:15Z
Repository: https://github.com/OpenOLAT/OpenOLAT
Language: Java
Files changed: src/main/java/org/olat/core/commons/services/doceditor/drawio/manager/DrawioServiceImpl.java
Commit date: 2024-01-24 10:17:18 +0100
Commit message: OO-7553: Extract XML from SVG with secure settings
Diff: diff --git a/src/main/java/org/olat/core/commons/services/doceditor/drawio/manager/DrawioServiceImpl.java b/src/main/java/org/olat/core/commons/services/doceditor/drawio/manager/DrawioServiceImpl.java
index f933b4741f6..f2fb3d0eea4 100644
--- a/src/main/java/org/olat/core/commons/services/doceditor/drawio/manager/DrawioServiceImpl.java
+++ b/src/main/java/org/olat/core/commons/services/doceditor/drawio/manager/DrawioServiceImpl.java
@@ -51,10 +51,11 @@ import org.olat.core.util.vfs.VFSLeaf;
 import org.olat.core.util.vfs.VFSLockApplicationType;
 import org.olat.core.util.vfs.VFSLockManager;
 import org.olat.core.util.vfs.VFSManager;
 import org.olat.core.util.vfs.lock.LockInfo;
 import org.olat.core.util.vfs.lock.LockResult;
+import org.olat.core.util.xml.XMLFactories;
 import org.olat.restapi.security.RestSecurityHelper;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.w3c.dom.Document;
 import org.w3c.dom.NodeList;
@@ -137,11 +138,11 @@ public class DrawioServiceImpl implements DrawioService {
 		String xml = null;
 
 		String suffix = FileUtils.getFileSuffix(vfsLeaf.getName());
 		if ("svg".equalsIgnoreCase(suffix)) {
 			try {
-				DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+				DocumentBuilderFactory factory = XMLFactories.newDocumentBuilderFactory();
 				DocumentBuilder builder = factory.newDocumentBuilder();
 				Document document = builder.parse(vfsLeaf.getInputStream());
 				String xpathExpression = "//svg/@content";
 				XPathFactory xpf = XPathFactory.newInstance();
 				XPath xpath = xpf.newXPath();

Vulnerable code: 				DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
Fixed code: import org.olat.core.util.xml.XMLFactories;
				DocumentBuilderFactory factory = XMLFactories.newDocumentBuilderFactory();
CVE-2021-39182: Inadequate Encryption Strength (CWE-326)
value: EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 7.5
Published: 2021-11-08T15:15Z
Repository: https://github.com/Morgan-Phoenix/EnroCrypt
Language: Python
Files changed: enrocrypt/hashing.py
Commit date: 2021-11-06 19:34:45 +0530
Commit message: Fixed GHSA-35m5-8cvj-8783

Diff: diff --git a/enrocrypt/hashing.py b/enrocrypt/hashing.py
index 275d2e3..14328f0 100644
--- a/enrocrypt/hashing.py
+++ b/enrocrypt/hashing.py
@@ -64,15 +64,10 @@ class Hashing():
     def SHA244(self,data:str):
         sha = hashlib.sha224(bytes(data.encode()))
         hash = str(sha.digest())
         return self.__Salt(hash,salt=self.salt)
 
-    def MD5(self,data:str):
-        sha = hashlib.md5(bytes(data.encode()))
-        hash = str(sha.digest())
-        return self.__Salt(hash,salt=self.salt)
-
     def SHA384(self,data:str):
         sha = hashlib.sha384(bytes(data.encode()))
         hash = str(sha.digest())
         return self.__Salt(hash,salt=self.salt)
 

Vulnerable code:     def MD5(self,data:str):
        sha = hashlib.md5(bytes(data.encode()))
        hash = str(sha.digest())
        return self.__Salt(hash,salt=self.salt)
CVE-2023-5632: Excessive Iteration (CWE-834)
value: In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6



CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 7.5
Published: 2023-10-18T09:15Z
Repository: https://github.com/eclipse/mosquitto
Language: C
Files changed: lib/packet_mosq.c
Commit date: 2021-01-28 09:28:36 +0000
Commit message: Unconditionally adding an event to the epoll causes 100% CPU usage. This happens when the connection to the server is established and the client has not sent any data yet.

Signed-off-by: Przemek Zygmunt <p.zygmunt@acsoftware.pl>

Diff: diff --git a/lib/packet_mosq.c b/lib/packet_mosq.c
index ad2a3aae..84f93cb8 100644
--- a/lib/packet_mosq.c
+++ b/lib/packet_mosq.c
@@ -214,11 +214,13 @@ int packet__write(struct mosquitto *mosq)
 
 	if(!mosq) return MOSQ_ERR_INVAL;
 	if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN;
 
 #ifdef WITH_BROKER
-	mux__add_out(mosq);
+	if (mosq->current_out_packet) {
+	   mux__add_out(mosq);
+	}
 #endif
 
 	pthread_mutex_lock(&mosq->current_out_packet_mutex);
 	pthread_mutex_lock(&mosq->out_packet_mutex);
 	if(mosq->out_packet && !mosq->current_out_packet){

Vulnerable code: 	mux__add_out(mosq);
Fixed code: 	if (mosq->current_out_packet) {
	   mux__add_out(mosq);
	}
CVE-2024-1879: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2024-06-06T18:15Z
Repository: https://github.com/significant-gravitas/autogpt
Language: Other
Files changed: autogpts/autogpt/.env.template
Commit date: 2024-04-26 19:35:09 +0200
Commit message: fix(agent): Update .env.template to match changes in 370615e

Diff: diff --git a/autogpts/autogpt/.env.template b/autogpts/autogpt/.env.template
index a79f97b6..b5fb32c0 100644
--- a/autogpts/autogpt/.env.template
+++ b/autogpts/autogpt/.env.template
@@ -88,15 +88,15 @@ OPENAI_API_KEY=your-openai-api-key
 
 ################################################################################
 ### LLM MODELS
 ################################################################################
 
-## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
-# SMART_LLM=gpt-4-turbo-preview
+## SMART_LLM - Smart language model (Default: gpt-4-turbo)
+# SMART_LLM=gpt-4-turbo
 
-## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
-# FAST_LLM=gpt-3.5-turbo-0125
+## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
+# FAST_LLM=gpt-3.5-turbo
 
 ## EMBEDDING_MODEL - Model to use for creating embeddings
 # EMBEDDING_MODEL=text-embedding-3-small
 
 ################################################################################

Vulnerable code: ## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
# SMART_LLM=gpt-4-turbo-preview
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
# FAST_LLM=gpt-3.5-turbo-0125
Fixed code: ## SMART_LLM - Smart language model (Default: gpt-4-turbo)
# SMART_LLM=gpt-4-turbo
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
# FAST_LLM=gpt-3.5-turbo
CVE-2024-1880: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS command within the `_speech` method of the MacOSTTS class. Specifically, the use of `os.system` to execute the `say` command with user-supplied text allows for arbitrary code execution if an attacker can inject shell commands. This issue is triggered when the AutoGPT instance is run with the `--speak` option enabled and configured with `TEXT_TO_SPEECH_PROVIDER=macos`, reflecting back a shell injection snippet. The impact of this vulnerability is the potential execution of arbitrary code on the instance running AutoGPT. The issue was addressed in version 5.1.0.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Published: 2024-06-06T19:15Z
Repository: https://github.com/significant-gravitas/autogpt
Language: Other
Files changed: autogpts/autogpt/.env.template
Commit date: 2024-04-26 19:35:09 +0200
Commit message: fix(agent): Update .env.template to match changes in 370615e

Diff: diff --git a/autogpts/autogpt/.env.template b/autogpts/autogpt/.env.template
index a79f97b6..b5fb32c0 100644
--- a/autogpts/autogpt/.env.template
+++ b/autogpts/autogpt/.env.template
@@ -88,15 +88,15 @@ OPENAI_API_KEY=your-openai-api-key
 
 ################################################################################
 ### LLM MODELS
 ################################################################################
 
-## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
-# SMART_LLM=gpt-4-turbo-preview
+## SMART_LLM - Smart language model (Default: gpt-4-turbo)
+# SMART_LLM=gpt-4-turbo
 
-## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
-# FAST_LLM=gpt-3.5-turbo-0125
+## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
+# FAST_LLM=gpt-3.5-turbo
 
 ## EMBEDDING_MODEL - Model to use for creating embeddings
 # EMBEDDING_MODEL=text-embedding-3-small
 
 ################################################################################

Vulnerable code: ## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
# SMART_LLM=gpt-4-turbo-preview
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
# FAST_LLM=gpt-3.5-turbo-0125
Fixed code: ## SMART_LLM - Smart language model (Default: gpt-4-turbo)
# SMART_LLM=gpt-4-turbo
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
# FAST_LLM=gpt-3.5-turbo
CVE-2024-1881: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Injection') due to a flaw in its shell command validation function. Specifically, the vulnerability exists in versions v0.5.0 up to but not including 5.1.0. The issue arises from the application's method of validating shell commands against an allowlist or denylist, where it only checks the first word of the command. This allows an attacker to bypass the intended restrictions by crafting commands that are executed despite not being on the allowlist or by including malicious commands not present in the denylist. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary shell commands.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Published: 2024-06-06T19:15Z
Repository: https://github.com/significant-gravitas/autogpt
Language: Other
Files changed: autogpts/autogpt/.env.template
Commit date: 2024-04-26 19:35:09 +0200
Commit message: fix(agent): Update .env.template to match changes in 370615e

Diff: diff --git a/autogpts/autogpt/.env.template b/autogpts/autogpt/.env.template
index a79f97b6..b5fb32c0 100644
--- a/autogpts/autogpt/.env.template
+++ b/autogpts/autogpt/.env.template
@@ -88,15 +88,15 @@ OPENAI_API_KEY=your-openai-api-key
 
 ################################################################################
 ### LLM MODELS
 ################################################################################
 
-## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
-# SMART_LLM=gpt-4-turbo-preview
+## SMART_LLM - Smart language model (Default: gpt-4-turbo)
+# SMART_LLM=gpt-4-turbo
 
-## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
-# FAST_LLM=gpt-3.5-turbo-0125
+## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
+# FAST_LLM=gpt-3.5-turbo
 
 ## EMBEDDING_MODEL - Model to use for creating embeddings
 # EMBEDDING_MODEL=text-embedding-3-small
 
 ################################################################################

Vulnerable code: ## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
# SMART_LLM=gpt-4-turbo-preview
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
# FAST_LLM=gpt-3.5-turbo-0125
Fixed code: ## SMART_LLM - Smart language model (Default: gpt-4-turbo)
# SMART_LLM=gpt-4-turbo
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
# FAST_LLM=gpt-3.5-turbo
CVE-2014-9496: Insufficient Information (NVD-CWE-noinfo)
value: The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2015-01-16T16:59Z
Repository: https://github.com/erikd/libsndfile
Language: C
Files changed: src/sd2.c
Commit date: 2014-12-25 19:23:17 +1100
Commit message: src/sd2.c : Fix two potential buffer read overflows.

Closes: https://github.com/erikd/libsndfile/issues/93

Diff: diff --git a/src/sd2.c b/src/sd2.c
index 0b4e5af..a70a1f1 100644
--- a/src/sd2.c
+++ b/src/sd2.c
@@ -515,10 +515,15 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
 		goto parse_rsrc_fork_cleanup ;
 		} ;
 
 	rsrc.type_offset = rsrc.map_offset + 30 ;
 
+	if (rsrc.map_offset + 28 > rsrc.rsrc_len)
+	{	psf_log_printf (psf, "Bad map offset.\n") ;
+		goto parse_rsrc_fork_cleanup ;
+		} ;
+
 	rsrc.type_count = read_rsrc_short (&rsrc, rsrc.map_offset + 28) + 1 ;
 	if (rsrc.type_count < 1)
 	{	psf_log_printf (psf, "Bad type count.\n") ;
 		error = SFE_SD2_BAD_RSRC ;
 		goto parse_rsrc_fork_cleanup ;
@@ -531,11 +536,16 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
 		goto parse_rsrc_fork_cleanup ;
 		} ;
 
 	rsrc.str_index = -1 ;
 	for (k = 0 ; k < rsrc.type_count ; k ++)
-	{	marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
+	{	if (rsrc.type_offset + k * 8 > rsrc.rsrc_len)
+		{	psf_log_printf (psf, "Bad rsrc marker.\n") ;
+			goto parse_rsrc_fork_cleanup ;
+			} ;
+
+		marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
 
 		if (marker == STR_MARKER)
 		{	rsrc.str_index = k ;
 			rsrc.str_count = read_rsrc_short (&rsrc, rsrc.type_offset + k * 8 + 4) + 1 ;
 			error = parse_str_rsrc (psf, &rsrc) ;

Vulnerable code: 	{	marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
Fixed code: 	if (rsrc.map_offset + 28 > rsrc.rsrc_len)
	{	psf_log_printf (psf, "Bad map offset.\n") ;
		goto parse_rsrc_fork_cleanup ;
		} ;

	{	if (rsrc.type_offset + k * 8 > rsrc.rsrc_len)
		{	psf_log_printf (psf, "Bad rsrc marker.\n") ;
			goto parse_rsrc_fork_cleanup ;
			} ;

		marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
CVE-2014-9756: Divide By Zero (CWE-369)
value: The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
CWE description: The product divides a value by zero.
Published: 2015-11-19T20:59Z
Repository: https://github.com/erikd/libsndfile
Language: C
Files changed: src/file_io.c
Commit date: 2014-12-24 21:02:39 +1100
Commit message: src/file_io.c : Prevent potential divide-by-zero.

Closes: https://github.com/erikd/libsndfile/issues/92

Diff: diff --git a/src/file_io.c b/src/file_io.c
index 26d3d6d..6ccab78 100644
--- a/src/file_io.c
+++ b/src/file_io.c
@@ -1,7 +1,7 @@
 /*
-** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 2002-2014 Erik de Castro Lopo <erikd@mega-nerd.com>
 ** Copyright (C) 2003 Ross Bencina <rbencina@iprimus.com.au>
 **
 ** This program is free software; you can redistribute it and/or modify
 ** it under the terms of the GNU Lesser General Public License as published by
 ** the Free Software Foundation; either version 2.1 of the License, or
@@ -356,10 +356,13 @@ psf_fread (void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf)
 sf_count_t
 psf_fwrite (const void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf)
 {	sf_count_t total = 0 ;
 	ssize_t	count ;
 
+	if (bytes == 0 || items == 0)
+		return 0 ;
+
 	if (psf->virtual_io)
 		return psf->vio.write (ptr, bytes*items, psf->vio_user_data) / bytes ;
 
 	items *= bytes ;
 

Vulnerable code: ** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>
Fixed code: ** Copyright (C) 2002-2014 Erik de Castro Lopo <erikd@mega-nerd.com>
	if (bytes == 0 || items == 0)
		return 0 ;
CVE-2017-6892: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2017-06-12T16:29Z
Repository: https://github.com/erikd/libsndfile
Language: C
Files changed: src/aiff.c
Commit date: 2017-05-23 20:15:27 +1000
Commit message: src/aiff.c: Fix a buffer read overflow

Secunia Advisory SA76717.

Found by: Laurent Delosieres, Secunia Research at Flexera Software

Diff: diff --git a/src/aiff.c b/src/aiff.c
index 5b5f9f53..45864b76 100644
--- a/src/aiff.c
+++ b/src/aiff.c
@@ -1757,11 +1757,11 @@ aiff_read_chanmap (SF_PRIVATE * psf, unsigned dword)
 
 	if (bytesread < dword)
 		psf_binheader_readf (psf, "j", dword - bytesread) ;
 
 	if (map_info->channel_map != NULL)
-	{	size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;
+	{	size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;
 
 		free (psf->channel_map) ;
 
 		if ((psf->channel_map = malloc (chanmap_size)) == NULL)
 			return SFE_MALLOC_FAILED ;

Vulnerable code: 	{	size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;
Fixed code: 	{	size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;
CVE-2017-7586: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-04-07T20:59Z
Repository: https://github.com/erikd/libsndfile
Language: C
Files changed: src/id3.c
Commit date: 2017-04-02 18:13:30 +1000
Commit message: src/id3.c : Improve error handling

Diff: diff --git a/src/id3.c b/src/id3.c
index 2fd0a0b9..095b989d 100644
--- a/src/id3.c
+++ b/src/id3.c
@@ -1,7 +1,7 @@
 /*
-** Copyright (C) 2010-2011 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 2010-2017 Erik de Castro Lopo <erikd@mega-nerd.com>
 **
 ** This program is free software; you can redistribute it and/or modify
 ** it under the terms of the GNU Lesser General Public License as published by
 ** the Free Software Foundation; either version 2.1 of the License, or
 ** (at your option) any later version.
@@ -46,12 +46,14 @@ id3_skip (SF_PRIVATE * psf)
 		if (offset < 0)
 			return 0 ;
 
 		/* Calculate new file offset and position ourselves there. */
 		psf->fileoffset += offset + 10 ;
-		psf_binheader_readf (psf, "p", psf->fileoffset) ;
 
-		return 1 ;
+		if (psf->fileoffset < psf->filelength)
+		{	psf_binheader_readf (psf, "p", psf->fileoffset) ;
+			return 1 ;
+			} ;
 		} ;
 
 	return 0 ;
 } /* id3_skip */

Vulnerable code: ** Copyright (C) 2010-2011 Erik de Castro Lopo <erikd@mega-nerd.com>
		psf_binheader_readf (psf, "p", psf->fileoffset) ;
		return 1 ;
Fixed code: ** Copyright (C) 2010-2017 Erik de Castro Lopo <erikd@mega-nerd.com>
		if (psf->fileoffset < psf->filelength)
		{	psf_binheader_readf (psf, "p", psf->fileoffset) ;
			return 1 ;
			} ;
CVE-2020-36639: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument amx_votemap leads to path traversal. The patch is identified as a5f2b5539f6d61050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-01-04T10:15Z
Repository: https://github.com/alliedmodders/amxmodx
Language: Other
Files changed: plugins/adminvote.sma
Commit date: 2020-05-29 01:04:16 +0200
Commit message: adminvote.sma exploit fix (#823)

* Restrict having ".." character sequence in amx_votemap command arguments

Fixes exploit on Windows servers that allows executing potentially dangerous console commands

* Fix typo

containi -> contain
Diff: diff --git a/plugins/adminvote.sma b/plugins/adminvote.sma
index 9e0d5372..f1d2ebb5 100755
--- a/plugins/adminvote.sma
+++ b/plugins/adminvote.sma
@@ -236,11 +236,14 @@ public cmdVoteMap(id, level, cid)
 	g_optionName[3][0] = 0
 	
 	for (new i = 1; i < argc; ++i)
 	{
 		read_argv(i, g_optionName[g_validMaps], 31)
-		
+
+		if (contain(g_optionName[g_validMaps], "..") != -1)
+			continue
+
 		if (is_map_valid(g_optionName[g_validMaps]))
 			g_validMaps++
 	}
 	
 	if (g_validMaps == 0)

Fixed code: 
		if (contain(g_optionName[g_validMaps], "..") != -1)
			continue