Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-25916: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-03-16T16:15Z
Repository: https://github.com/pjshumphreys/patchmerge
Language: JavaScript
Files changed: index.js, test2.js
Commit date: 2021-03-10 16:48:02 +0000
Commit message: don't inadvertantly modify Object.prototype

Diff: diff --git a/index.js b/index.js
index bb62259..cb73ee6 100644
--- a/index.js
+++ b/index.js
@@ -100,10 +100,21 @@ const objectMerge = (original, patch, removeMode) => {
     else if(isArr) {
       original[name] = arrayMerge(original[name], patch[name], removeMode);
     }
     //merge objects
     else {
+      //Don't implicitly mutate Object.prototype but subsitute an empty object
+      if(original[name] === Object.prototype) {
+        delete original[name];
+
+        Object.defineProperty(original, name, {
+          enumerable: true,
+          writable: true,
+          value: {}
+        });
+      }
+
       original[name] = objectMerge(original[name], patch[name], removeMode);
     }
   }
 
   return original;
diff --git a/test2.js b/test2.js
new file mode 100644
index 0000000..1be069c
--- /dev/null
+++ b/test2.js
@@ -0,0 +1,5 @@
+patchMerge = require('./index.js');
+var obj = {}
+console.log("Before : " + obj.isAdmin);
+console.log(patchMerge(obj, JSON.parse('{ "__proto__": { "isAdmin": true }}')));
+console.log("After : " + obj.isAdmin);

Fixed code:       //Don't implicitly mutate Object.prototype but subsitute an empty object
      if(original[name] === Object.prototype) {
        delete original[name];

        Object.defineProperty(original, name, {
          enumerable: true,
          writable: true,
          value: {}
        });
      }

patchMerge = require('./index.js');
var obj = {}
console.log("Before : " + obj.isAdmin);
console.log(patchMerge(obj, JSON.parse('{ "__proto__": { "isAdmin": true }}')));
console.log("After : " + obj.isAdmin);
CVE-2020-15471: Out-of-bounds Read (CWE-125)
value: In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2020-07-01T11:15Z
Repository: https://github.com/ntop/nDPI
Language: C
Files changed: src/lib/ndpi_main.c
Commit date: 2020-05-29 21:43:06 +0200
Commit message: Added check for heap buffer overflow read

Diff: diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 7199f72e..a062cdc8 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -4805,33 +4805,38 @@ u_int64_t ndpi_bytestream_dec_or_hex_to_number64(const u_int8_t *str, u_int16_t
 u_int32_t ndpi_bytestream_to_ipv4(const u_int8_t *str, u_int16_t max_chars_to_read, u_int16_t *bytes_read) {
   u_int32_t val;
   u_int16_t read = 0;
   u_int16_t oldread;
   u_int32_t c;
+
   /* ip address must be X.X.X.X with each X between 0 and 255 */
   oldread = read;
   c = ndpi_bytestream_to_number(str, max_chars_to_read, &read);
   if(c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.')
     return(0);
+  
   read++;
   val = c << 24;
   oldread = read;
   c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read);
   if(c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.')
     return(0);
+  
   read++;
   val = val + (c << 16);
   oldread = read;
   c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read);
   if(c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.')
     return(0);
+  
   read++;
   val = val + (c << 8);
   oldread = read;
   c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read);
   if(c > 255 || oldread == read || max_chars_to_read == read)
     return(0);
+  
   val = val + c;
 
   *bytes_read = *bytes_read + read;
 
   return(htonl(val));
@@ -4867,13 +4872,14 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str,
 	 && (get_u_int16_t(packet->payload, a+2) == ntohs(0x0d0a))) {
 	/* \r\n\r\n */
 	int diff; /* No unsigned ! */
 	u_int32_t a1 = a + 4;
 
-	diff = ndpi_min(packet->payload_packet_len-a1, sizeof(flow->initial_binary_bytes));
+	diff = packet->payload_packet_len - a1;
 
 	if(diff > 0) {
+	  diff = ndpi_min(diff, sizeof(flow->initial_binary_bytes));
 	  memcpy(&flow->initial_binary_bytes, &packet->payload[a1], diff);
 	  flow->initial_binary_bytes_len = diff;
 	}
       }
 

Vulnerable code: 	diff = ndpi_min(packet->payload_packet_len-a1, sizeof(flow->initial_binary_bytes));
Fixed code: 
  
  
  
  
	diff = packet->payload_packet_len - a1;
	  diff = ndpi_min(diff, sizeof(flow->initial_binary_bytes));
CVE-2020-15476: Out-of-bounds Read (CWE-125)
value: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-07-01T11:15Z
Repository: https://github.com/ntop/nDPI
Language: C
Files changed: src/lib/protocols/oracle.c
Commit date: 2020-05-10 15:04:23 +0200
Commit message: Adds bound check in oracle protocol

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21780

Diff: diff --git a/src/lib/protocols/oracle.c b/src/lib/protocols/oracle.c
index 6ad6bac4c..a24837a68 100644
--- a/src/lib/protocols/oracle.c
+++ b/src/lib/protocols/oracle.c
@@ -41,11 +41,11 @@ void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct
   if(packet->tcp != NULL) {
     sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest);
     NDPI_LOG_DBG2(ndpi_struct, "calculating ORACLE over tcp\n");
     /* Oracle Database 9g,10g,11g */
     if ((dport == 1521 || sport == 1521)
-	&&  (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
+	&&  (((packet->payload_packet_len >= 3 && packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
 	     || ((packet->payload_packet_len >= 232) && ((packet->payload[0] == 0x00) || (packet->payload[0] == 0x01)) 
 	     && (packet->payload[1] != 0x00)
 	     && (packet->payload[2] == 0x00)
 		 && (packet->payload[3] == 0x00)))) {
       NDPI_LOG_INFO(ndpi_struct, "found oracle\n");

Vulnerable code: 	&&  (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
Fixed code: 	&&  (((packet->payload_packet_len >= 3 && packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
CVE-2021-3639: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-08-22T15:15Z
Repository: https://github.com/latchset/mod_auth_mellon
Language: C
Files changed: auth_mellon_util.c
Commit date: 2021-07-29 13:35:44 +0200
Commit message: Prevent redirect to URLs that begin with '///'

Visiting a logout URL like this:
    https://rp.example.co.jp/mellon/logout?ReturnTo=///fishing-site.example.com/logout.html
would have redirected the user to fishing-site.example.com

With the patch, this URL would be rejected.

Fixes: CVE-2021-3639

Diff: diff --git a/auth_mellon_util.c b/auth_mellon_util.c
index 2f8c9c3..6a686db 100644
--- a/auth_mellon_util.c
+++ b/auth_mellon_util.c
@@ -925,10 +925,14 @@ char *am_urlencode(apr_pool_t *pool, const char *str)
  */
 int am_check_url(request_rec *r, const char *url)
 {
     const char *i;
 
+    if (url == NULL) {
+        return HTTP_BAD_REQUEST;
+    }
+
     for (i = url; *i; i++) {
         if (*i >= 0 && *i < ' ') {
             /* Deny all control-characters. */
             AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
                           "Control character detected in URL.");
@@ -941,10 +945,16 @@ int am_check_url(request_rec *r, const char *url)
                           "Backslash character detected in URL.");
             return HTTP_BAD_REQUEST;
         }
     }
 
+    if (strstr(url, "///") == url) {
+        AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
+                          "URL starts with '///'");
+        return HTTP_BAD_REQUEST;
+    }
+
     return OK;
 }
 
 /* This function generates a given number of (pseudo)random bytes.
  * The current implementation uses OpenSSL's RAND_*-functions.

Fixed code:     if (url == NULL) {
        return HTTP_BAD_REQUEST;
    }

    if (strstr(url, "///") == url) {
        AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
                          "URL starts with '///'");
        return HTTP_BAD_REQUEST;
    }
CVE-2021-21330: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-02-26T03:15Z
Repository: https://github.com/aio-libs/aiohttp
Language: Unknown
Commit date: 2021-02-25 18:58:51 +0100
Commit message: Merge branch 'ghsa-v6wp-4m6f-gcjg' into master

This patch fixes an open redirect vulnerability bug in
`aiohttp.web_middlewares.normalize_path_middleware` by
making sure that there's at most one slash at the
beginning of the `Location` header value.

Refs:
* https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
* https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
CVE-2022-1849: Session Fixation (CWE-384)
value: Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 5.4
Published: 2022-05-24T16:15Z
Repository: https://github.com/filegator/filegator
Language: PHP
Files changed: backend/Services/Auth/Adapters/JsonFile.php
Commit date: 2022-05-24 13:08:43 +0200
Commit message: regenerate session on user update

Diff: diff --git a/backend/Services/Auth/Adapters/JsonFile.php b/backend/Services/Auth/Adapters/JsonFile.php
index b9c38a3..af16d50 100644
--- a/backend/Services/Auth/Adapters/JsonFile.php
+++ b/backend/Services/Auth/Adapters/JsonFile.php
@@ -51,11 +51,11 @@ class JsonFile implements Service, AuthInterface
         $user = $this->session->get(self::SESSION_KEY, null);
         $hash = $this->session->get(self::SESSION_HASH, null);
 
         if ($user) {
             foreach ($this->getUsers() as $u) {
-                if ($u['username'] == $user->getUsername() && $hash == $u['password']) {
+                if ($u['username'] == $user->getUsername() && $hash == $u['password'].$u['permissions'].$u['homedir'].$u['role']) {
                     return $user;
                 }
             }
         }
 
@@ -68,11 +68,11 @@ class JsonFile implements Service, AuthInterface
 
         foreach ($all_users as &$u) {
             if ($u['username'] == $username && $this->verifyPassword($password, $u['password'])) {
                 $user = $this->mapToUserObject($u);
                 $this->store($user);
-                $this->session->set(self::SESSION_HASH, $u['password']);
+                $this->session->set(self::SESSION_HASH, $u['password'].$u['permissions'].$u['homedir'].$u['role']);
 
                 return true;
             }
         }
 

Vulnerable code:                 if ($u['username'] == $user->getUsername() && $hash == $u['password']) {
                $this->session->set(self::SESSION_HASH, $u['password']);
Fixed code:                 if ($u['username'] == $user->getUsername() && $hash == $u['password'].$u['permissions'].$u['homedir'].$u['role']) {
                $this->session->set(self::SESSION_HASH, $u['password'].$u['permissions'].$u['homedir'].$u['role']);
CVE-2018-1002203: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2018-07-25T17:29Z
Repository: https://github.com/ZJONSSON/node-unzipper
Language: Unknown
Commit date: 2018-04-16 09:32:34 -0400
Commit message: Merge pull request #59 from aviadatsnyk/fix/zip-slip

fix: prevent extracting archived files outside of target path
CVE-2021-4310: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as ae849b347a58c2cb1be38d04bbe56fc883d5d84a. It is recommended to apply a patch to fix this issue. VDB-217662 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-09T09:15Z
Repository: https://github.com/01-Scripts/01-Artikelsystem
Language: PHP
Files changed: 01article.php
Commit date: 2021-09-15 15:37:40 +0200
Commit message: Hotfix: XSS-Vulnerability $_SERVER['PHP_SELF']
https://seancoates.com/blogs/xss-woes

Diff: diff --git a/01article.php b/01article.php
index d01c87e..fd1f265 100644
--- a/01article.php
+++ b/01article.php
@@ -48,11 +48,11 @@ include_once($moduldir.$modulvz."_headinclude.php");
 include_once($moduldir.$modulvz."_functions.php");
 
 // Variablen
 $imagepf 	= $moduldir.$modulvz.$imagepf;          // Pfad zum Bild-Verzeichnis
 $tempdir	= $moduldir.$modulvz.$tempdir;			// Template-Verzeichnis
-$filename	= $_SERVER['PHP_SELF'];					// Variable enthält die Adresse der Datei, auf der das Artikelsystem eingebunden wurde
+$filename	= $_SERVER['SCRIPT_NAME'];	            // Variable enthält die Adresse der Datei, auf der das Artikelsystem eingebunden wurde
 $flag_comments_js	= TRUE;							// Kommentar-Feld per Default via JavaScript ausblenden?
 
 // Language-File einbinden
 include_once($tempdir."lang_vars.php");
 

Vulnerable code: $filename	= $_SERVER['PHP_SELF'];					// Variable enthält die Adresse der Datei, auf der das Artikelsystem eingebunden wurde
Fixed code: $filename	= $_SERVER['SCRIPT_NAME'];	            // Variable enthält die Adresse der Datei, auf der das Artikelsystem eingebunden wurde
CVE-2018-1000809: Improper Input Validation (CWE-20)
value: privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-10-08T15:29Z
Repository: https://github.com/privacyidea/privacyidea
Language: Unknown
Commit date: 2018-09-07 14:33:56 +0200
Commit message: Merge branch 'branch-2.23'
CVE-2020-12658: Improper Locking (CWE-667)
value: gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.
CWE description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CVSS v3 base score: 9.8
Published: 2020-12-31T01:15Z
Repository: https://github.com/gssapi/gssproxy
Language: C
Files changed: src/gp_workers.c
Commit date: 2020-03-26 13:54:17 -0400
Commit message: Unlock cond_mutex before pthread exit in gp_worker_main()

Signed-off-by: GuiYao <guiyao@huawei.com>
[rharwood@redhat.com: whitespace, tweak commit message]
Reviewed-by: Robbie Harwood <rharwood@redhat.com>

Diff: diff --git a/src/gp_workers.c b/src/gp_workers.c
index 18f38f6..ae42cef 100644
--- a/src/gp_workers.c
+++ b/src/gp_workers.c
@@ -367,10 +367,11 @@ static void *gp_worker_main(void *pvt)
         pthread_mutex_lock(&t->cond_mutex);
         while (t->query == NULL) {
             /* wait for next query */
             pthread_cond_wait(&t->cond_wakeup, &t->cond_mutex);
             if (t->pool->shutdown) {
+                pthread_mutex_unlock(&t->cond_mutex);
                 pthread_exit(NULL);
             }
         }
 
         /* grab the query off the shared pointer */

Fixed code:                 pthread_mutex_unlock(&t->cond_mutex);
CVE-2018-6343: Improper Input Validation (CWE-20)
value: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-12-31T22:29Z
Repository: https://github.com/facebook/proxygen
Language: C++
Files changed: proxygen/lib/http/session/HTTPSession.cpp
Commit date: 2018-11-12 15:38:39 -0800
Commit message: Check that a secondary auth manager is set before dereferencing.

Summary: CVE-2018-6343

Reviewed By: mingtaoy

Differential Revision: D12994423

fbshipit-source-id: 9229ec11da8085f1fa153595e8e5353e19d06fb7

Diff: diff --git a/proxygen/lib/http/session/HTTPSession.cpp b/proxygen/lib/http/session/HTTPSession.cpp
index 71152b24..95b34c6e 100644
--- a/proxygen/lib/http/session/HTTPSession.cpp
+++ b/proxygen/lib/http/session/HTTPSession.cpp
@@ -1347,10 +1347,14 @@ void HTTPSession::onPriority(HTTPCodec::StreamID streamID,
 void HTTPSession::onCertificateRequest(uint16_t requestId,
                                        std::unique_ptr<IOBuf> authRequest) {
   DestructorGuard dg(this);
   VLOG(4) << "CERTIFICATE_REQUEST on" << *this << ", requestId=" << requestId;
 
+  if (!secondAuthManager_) {
+    return;
+  }
+
   std::pair<uint16_t, std::unique_ptr<folly::IOBuf>> authenticator;
   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();
   if (fizzBase) {
     if (isUpstream()) {
       authenticator =
@@ -1380,10 +1384,14 @@ void HTTPSession::onCertificateRequest(uint16_t requestId,
 void HTTPSession::onCertificate(uint16_t certId,
                                 std::unique_ptr<IOBuf> authenticator) {
   DestructorGuard dg(this);
   VLOG(4) << "CERTIFICATE on" << *this << ", certId=" << certId;
 
+  if (!secondAuthManager_) {
+    return;
+  }
+
   bool isValid = false;
   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();
   if (fizzBase) {
     if (isUpstream()) {
       isValid = secondAuthManager_->validateAuthenticator(

Fixed code:   if (!secondAuthManager_) {
    return;
  }

  if (!secondAuthManager_) {
    return;
  }
CVE-2022-0905: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 7.1
Published: 2022-03-10T15:15Z
Repository: https://github.com/go-gitea/gitea
Language: Go
Files changed: modules/auth/pam/pam.go
Commit date: 2022-03-10 10:00:05 +0800
Commit message: fix pam authorization (#19040)

https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb/

Co-authored-by: ysf <34326+ysf@users.noreply.github.com>
Diff: diff --git a/modules/auth/pam/pam.go b/modules/auth/pam/pam.go
index 30f13e440..0a3d8e9f9 100644
--- a/modules/auth/pam/pam.go
+++ b/modules/auth/pam/pam.go
@@ -32,10 +32,14 @@ func Auth(serviceName, userName, passwd string) (string, error) {
 	}
 
 	if err = t.Authenticate(0); err != nil {
 		return "", err
 	}
+	
+	if err = t.AcctMgmt(0); err != nil {
+	  return "", err
+  }
 
 	// PAM login names might suffer transformations in the PAM stack.
 	// We should take whatever the PAM stack returns for it.
 	return t.GetItem(pam.User)
 }

Fixed code: 	
	if err = t.AcctMgmt(0); err != nil {
	  return "", err
  }
CVE-2023-3515: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 4.4
Published: 2023-07-05T15:15Z
Repository: https://github.com/go-gitea/gitea
Language: Go
Files changed: modules/context/context_response.go
Commit date: 2023-06-08 14:08:14 +0000
Commit message: Fix open redirect check for more cases (#25143)

If redirect_to parameter has set value starting with `\\example.com`
redirect will be created with header `Location: /\\example.com` that
will redirect to example.com domain.
Diff: diff --git a/modules/context/context_response.go b/modules/context/context_response.go
index aeeb51ba37..1f215eb8ad 100644
--- a/modules/context/context_response.go
+++ b/modules/context/context_response.go
@@ -47,13 +47,13 @@ func (ctx *Context) RedirectToFirst(location ...string) {
 	for _, loc := range location {
 		if len(loc) == 0 {
 			continue
 		}
 
-		// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
+		// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
 		// Therefore we should ignore these redirect locations to prevent open redirects
-		if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
+		if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
 			continue
 		}
 
 		u, err := url.Parse(loc)
 		if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) {

Vulnerable code: 		// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
		if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
Fixed code: 		// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
		if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
CVE-2022-31049: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-14T21:15Z
Repository: https://github.com/TYPO3/typo3
Language: HTML
Files changed: typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
Commit date: 2022-06-14 09:18:33 +0200
Commit message: [SECURITY] Avoid HTML injection in password recovery mail

The `receiverName` variable used in the password recovery mail of the
Extbase felogin plugin was susceptible to HTML injection due to
missing sanitization. The variable is now passed thru the
`f:format.htmlspecialchars` ViewHelper.

Resolves: #96559
Releases: main, 11.5, 10.4
Change-Id: I60e23c161f7f2fcc87b8870345b10a4c31d7b8db
Security-Bulletin: TYPO3-CORE-SA-2022-004
Security-References: CVE-2022-31049
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74904
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Diff: diff --git a/typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html b/typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
index b6eb95d7f04..9ce5344654b 100644
--- a/typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
+++ b/typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
@@ -7,10 +7,10 @@
         </f:variable>
 
         {f:translate(
         key: 'forgot_validate_reset_password_html',
         extensionName: 'felogin',
-        arguments: '{ 0: receiverName, 1: recoveryLink, 2: validUntil }'
+        arguments: '{ 0: "{receiverName -> f:format.htmlspecialchars()}", 1: recoveryLink, 2: validUntil }'
         ) -> f:format.html()}
     </f:spaceless>
 </f:section>
 </html>

Vulnerable code:         arguments: '{ 0: receiverName, 1: recoveryLink, 2: validUntil }'
Fixed code:         arguments: '{ 0: "{receiverName -> f:format.htmlspecialchars()}", 1: recoveryLink, 2: validUntil }'
CVE-2022-36106: Improper Authentication (CWE-287)
value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.4
Published: 2022-09-13T18:15Z
Repository: https://github.com/TYPO3/typo3
Language: PHP
Files changed: typo3/sysext/backend/Classes/Authentication/PasswordReset.php
Commit date: 2022-09-13 10:09:20 +0200
Commit message: [SECURITY] Respect expiration time of password reset token

When a TYPO3 backend user performs a password reset request, a
password reset link including an expiration time is sent to the
user. The expiration time is included in HMAC calculation of
the saved password reset hash, but it is never evaluated if the
expiration time is exceeded.

This change adds the missing validity check for the expiration
time included in the password reset link.

Resolves: #97998
Releases: main, 11.5, 10.4
Change-Id: I8a1730faf6489e5c5eebb44ff4f82606785bd637
Security-Bulletin: TYPO3-CORE-SA-2022-008
Security-References: CVE-2022-36106
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75717
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Diff: diff --git a/typo3/sysext/backend/Classes/Authentication/PasswordReset.php b/typo3/sysext/backend/Classes/Authentication/PasswordReset.php
index 506708597ceb..ca0b1efd9feb 100644
--- a/typo3/sysext/backend/Classes/Authentication/PasswordReset.php
+++ b/typo3/sysext/backend/Classes/Authentication/PasswordReset.php
@@ -276,10 +276,15 @@ class PasswordReset implements LoggerAwareInterface
      * @param int $expirationTimestamp
      * @return array|null the BE User database record
      */
     protected function findValidUserForToken(string $token, string $identity, int $expirationTimestamp): ?array
     {
+        // Early return if token expired
+        if ($expirationTimestamp < time()) {
+            return null;
+        }
+
         $user = null;
         // Find the token in the database
         $queryBuilder = $this->getPreparedQueryBuilder();
 
         $queryBuilder

Fixed code:         // Early return if token expired
        if ($expirationTimestamp < time()) {
            return null;
        }
CVE-2024-34355: Insufficient Information (NVD-CWE-noinfo)
value: TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T16:17Z
Repository: https://github.com/TYPO3/typo3
Language: HTML
Files changed: typo3/sysext/backend/Resources/Private/Partials/RecordHistory/History.html
Commit date: 2024-05-14 10:02:49 +0200
Commit message: [SECURITY] Prevent HTML Injection in History Backend Module

Encode non prepared output of BackendUtility::getRecordTitle.
The string returned by getRecordTitle is only HTML encoded if
the third parameter (`$prep`) is set to true. ensure that
non-prepared usages are encoded on render.

Resolves: #103406
Releases: main, 13.1
Change-Id: I2aeefc20d526078ef905905b136dcd405fda337a
Security-Bulletin: TYPO3-CORE-SA-2024-007
Security-References: CVE-2024-34355
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/84264
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Diff: diff --git a/typo3/sysext/backend/Resources/Private/Partials/RecordHistory/History.html b/typo3/sysext/backend/Resources/Private/Partials/RecordHistory/History.html
index c86fd6e3206d..60e1759afa23 100644
--- a/typo3/sysext/backend/Resources/Private/Partials/RecordHistory/History.html
+++ b/typo3/sysext/backend/Resources/Private/Partials/RecordHistory/History.html
@@ -61,11 +61,11 @@
                             <span title="id={historyRow.recordUid}">
                                 <core:iconForRecord table="{historyRow.recordTable}" row="{historyRow}" />
                             </span>
                         </td>
                         <td class="col-recordtitle">
-                            {historyRow.title -> f:format.raw()} ({historyRow.recordTable}:{historyRow.recordUid})
+                            {historyRow.title} ({historyRow.recordTable}:{historyRow.recordUid})
                         </td>
                         <td class="col-action">
                             <f:variable name="actionTypeClass">
                                 <f:switch expression="{historyRow.actiontype}">
                                     <f:case value="1">success</f:case>

Vulnerable code:                             {historyRow.title -> f:format.raw()} ({historyRow.recordTable}:{historyRow.recordUid})
Fixed code:                             {historyRow.title} ({historyRow.recordTable}:{historyRow.recordUid})
CVE-2015-5719: Insufficient Information (NVD-CWE-noinfo)
value: app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2016-09-03T20:59Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: VERSION.json, app/Controller/TemplatesController.php
Commit date: 2015-07-01 11:06:11 +0200
Commit message: Fix to an incorrect validation of temporary filenames

Diff: diff --git a/VERSION.json b/VERSION.json
index 7174a97d..1ecf2522 100644
--- a/VERSION.json
+++ b/VERSION.json
@@ -1 +1 @@
-{"major":2, "minor":3, "hotfix":91}
\ No newline at end of file
+{"major":2, "minor":3, "hotfix":92}
\ No newline at end of file
diff --git a/app/Controller/TemplatesController.php b/app/Controller/TemplatesController.php
index 59de3538..95772eb8 100644
--- a/app/Controller/TemplatesController.php
+++ b/app/Controller/TemplatesController.php
@@ -332,11 +332,11 @@ class TemplatesController extends AppController {
 			if (isset($this->request->data['Template']['attributes'])) {
 				$attributes = json_decode($this->request->data['Template']['attributes'], true);
 				$this->loadModel('Attribute');
 				$fails = 0;
 				foreach($attributes as $k => &$attribute) {
-					if (isset($attribute['data'])) {
+					if (isset($attribute['data']) && preg_match('/^[a-zA-Z0-9]{12}$/', $attribute['data'])) {
 						$file = new File(APP . 'tmp/files/' . $attribute['data']);
 						$content = $file->read();
 						$attribute['data'] = base64_encode($content);
 						$file->delete();
 					}

Vulnerable code: {"major":2, "minor":3, "hotfix":91}
					if (isset($attribute['data'])) {
Fixed code: {"major":2, "minor":3, "hotfix":92}
					if (isset($attribute['data']) && preg_match('/^[a-zA-Z0-9]{12}$/', $attribute['data'])) {
CVE-2017-14337: Improper Authentication (CWE-287)
value: When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2017-09-12T16:29Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php
Commit date: 2017-09-08 14:25:36 +0200
Commit message: fix: Fix to certauth pains

Diff: diff --git a/app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php b/app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php
index ce3d18db4..1ad5c481f 100644
--- a/app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php
+++ b/app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php
@@ -131,21 +131,23 @@ class CertificateAuthenticate extends BaseAuthenticate
 			if (self::$client) {
 				self::$user = self::$client;
 				// If $sync is true, allow the creation of the user from the certificate
 				$sync = Configure::read('CertAuth.syncUser');
 				if ($sync) {
-					self::getRestUser();
+					if (!self::getRestUser()) return false;
 				}
 
 				// find and fill user with model
 				$userModelKey = empty(Configure::read('CertAuth.userModelKey')) ? 'email' : Configure::read('CertAuth.userModelKey');
 				$userDefaults = Configure::read('CertAuth.userDefaults');
 				$this->User = ClassRegistry::init('User');
-				$existingUser = $this->User->find('first', array(
-					'conditions' => array($userModelKey => self::$user[$userModelKey]),
-					'recursive' => false
-				));
+				if (!empty(self::$user[$userModelKey])) {
+					$existingUser = $this->User->find('first', array(
+						'conditions' => array($userModelKey => self::$user[$userModelKey]),
+						'recursive' => false
+					));
+				}
 				if ($existingUser) {
 					if ($sync) {
 						if (!isset(self::$user['org_id']) && isset(self::$user['org'])) {
 							self::$user['org_id'] = $this->User->Organisation->createOrgFromName(self::$user['org'], $existingUser['User']['id'], true);
 							// reset user defaults in case it's a different org_id

Vulnerable code: 					self::getRestUser();
				$existingUser = $this->User->find('first', array(
					'conditions' => array($userModelKey => self::$user[$userModelKey]),
					'recursive' => false
				));
Fixed code: 					if (!self::getRestUser()) return false;
				if (!empty(self::$user[$userModelKey])) {
					$existingUser = $this->User->find('first', array(
						'conditions' => array($userModelKey => self::$user[$userModelKey]),
						'recursive' => false
					));
				}
CVE-2017-16802: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-11-13T16:29Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/AppController.php, app/webroot/js/misp.js
Commit date: 2017-11-13 09:25:44 +0100
Commit message: fix: Fixed a reflected XSS in the sharing group creator tool

- Fixed a reflected XSS in the sharing group editor that requires malicious organisation names

- Low impact due to the following requirements:
  - organisation names with malicious org names (JS in the orgname)
  - sharing group editor user has to manually add an organisation to the list that has javascript in the org name
  - only vulnerable view is the editor itself, so the impact is limited to
    users that manually add organisations with malicious names to the list themselves / edit such sharing groups

- As reported by Dawid Czarnecki

Diff: diff --git a/app/Controller/AppController.php b/app/Controller/AppController.php
index 57f8aa027..2e07acef7 100755
--- a/app/Controller/AppController.php
+++ b/app/Controller/AppController.php
@@ -44,11 +44,11 @@ class AppController extends Controller {
 
 	public $debugMode = false;
 
 	public $helpers = array('Utility');
 
-	private $__queryVersion = '23';
+	private $__queryVersion = '24';
 	public $pyMispVersion = '2.4.82';
 	public $phpmin = '5.6.5';
 	public $phprec = '7.0.16';
 
 	// Used for _isAutomation(), a check that returns true if the controller & action combo matches an action that is a non-xml and non-json automation method
diff --git a/app/webroot/js/misp.js b/app/webroot/js/misp.js
index ae6a70227..67f833d5c 100644
--- a/app/webroot/js/misp.js
+++ b/app/webroot/js/misp.js
@@ -2056,11 +2056,11 @@ function sharingGroupPopulateOrganisations() {
 	var id = 0;
 	var html = '';
 	organisations.forEach(function(org) {
 		html = '<tr id="orgRow' + id + '" class="orgRow">';
 		html += '<td class="short">' + org.type + '&nbsp;</td>';
-		html += '<td>' + org.name + '&nbsp;</td>';
+		html += '<td>' + $('<div>').text(org.name).html() + '&nbsp;</td>';
 		html += '<td>' + org.uuid + '&nbsp;</td>';
 		html += '<td class="short" style="text-align:center;">';
 		if (org.removable == 1) {
 			html += '<input id="orgExtend' + id + '" type="checkbox" onClick="sharingGroupExtendOrg(' + id + ')" ';
 			if (org.extend) html+= 'checked';

Vulnerable code: 	private $__queryVersion = '23';
		html += '<td>' + org.name + '&nbsp;</td>';
Fixed code: 	private $__queryVersion = '24';
		html += '<td>' + $('<div>').text(org.name).html() + '&nbsp;</td>';
CVE-2017-16946: Insertion of Sensitive Information into Log File (CWE-532)
value: The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 4.9
Published: 2017-11-25T18:29Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/UsersController.php
Commit date: 2017-11-24 11:55:16 +0100
Commit message: fix: Leaking of hashed passwords in the audit logs fixed

- Scope was limited due to the audit log access restrictions to site/org admins

Diff: diff --git a/app/Controller/UsersController.php b/app/Controller/UsersController.php
index c140fe80e..431736113 100644
--- a/app/Controller/UsersController.php
+++ b/app/Controller/UsersController.php
@@ -642,11 +642,11 @@ class UsersController extends AppController {
 					// compare
 					$fieldsResultStr = '';
 					$c = 0;
 					foreach ($fields as $field) {
 						if (isset($fieldsOldValues[$c]) && $fieldsOldValues[$c] != $fieldsNewValues[$c]) {
-							if ($field != 'confirm_password') {
+							if ($field != 'confirm_password' && $field != 'enable_password') {
 								$fieldsResultStr = $fieldsResultStr . ', ' . $field . ' (' . $fieldsOldValues[$c] . ') => (' . $fieldsNewValues[$c] . ')';
 							}
 						}
 						$c++;
 					}

Vulnerable code: 							if ($field != 'confirm_password') {
Fixed code: 							if ($field != 'confirm_password' && $field != 'enable_password') {
CVE-2017-7215: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in app/View/Organisations/ajax/landingpage.ctp of MISP before 2.4.69 allows remote attackers to inject arbitrary web script or HTML.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-21T19:59Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Organisations/ajax/landingpage.ctp
Commit date: 2017-03-10 09:17:06 +0100
Commit message: fix: Tightened sanitisation in some view elements
- on the index filter tool
- organisation landing page

as reported by Tien Phan and David Maciejak of Fortinet's FortiGuard Labs.

Diff: diff --git a/app/View/Organisations/ajax/landingpage.ctp b/app/View/Organisations/ajax/landingpage.ctp
index 0d21e560d..4e556581d 100644
--- a/app/View/Organisations/ajax/landingpage.ctp
+++ b/app/View/Organisations/ajax/landingpage.ctp
@@ -1,6 +1,6 @@
 <div>
-<h3>Landing page for <?php echo $org;?></h3>
+<h3>Landing page for <?php echo h($org);?></h3>
 <div>
 <?php echo h($landingPage);?>
 </div>
 </div>
diff --git a/app/webroot/js/misp2.4.67.js b/app/webroot/js/misp2.4.68.js
similarity index 100%
rename from app/webroot/js/misp2.4.67.js
rename to app/webroot/js/misp2.4.68.js

Vulnerable code: <h3>Landing page for <?php echo $org;?></h3>
Fixed code: <h3>Landing page for <?php echo h($org);?></h3>
CVE-2018-11245: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-05-18T18:29Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/misp.js
Commit date: 2018-05-18 07:27:06 +0200
Commit message: fix: Fixed a DOM based XSS with cortex type attributes

- as reported by Dawid Czarnecki (dawid@pz.pl)

Diff: diff --git a/app/webroot/js/misp.js b/app/webroot/js/misp.js
index 1a81951da5..510115207f 100644
--- a/app/webroot/js/misp.js
+++ b/app/webroot/js/misp.js
@@ -3158,11 +3158,11 @@ function submitMISPUpdate() {
 	});
 }
 
 $(".cortex-json").click(function() {
 	var cortex_data = $(this).data('cortex-json');
-	cortex_data = JSON.stringify(cortex_data, null, 2);
+	cortex_data = htmlEncode(JSON.stringify(cortex_data, null, 2));
 	var popupHtml = '<pre class="simplepre">' + cortex_data + '</pre>';
 	popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>';
 	$('#screenshot_box').html(popupHtml);
 	$('#screenshot_box').show();
 	$('#screenshot_box').css({'padding': '5px'});

Vulnerable code: 	cortex_data = JSON.stringify(cortex_data, null, 2);
Fixed code: 	cortex_data = htmlEncode(JSON.stringify(cortex_data, null, 2));
CVE-2018-8949: Exposed Dangerous Method or Function (CWE-749)
value: An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute.
CWE description: The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CVSS v3 base score: 4.3
Published: 2018-03-23T17:29Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Attribute.php
Commit date: 2018-03-23 11:44:47 +0100
Commit message: fix: critical API integrity bug, potentially allowing users to delete attributes of other events

- a crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute

Diff: diff --git a/app/Model/Attribute.php b/app/Model/Attribute.php
index b1be7a5148..94ea0d387c 100644
--- a/app/Model/Attribute.php
+++ b/app/Model/Attribute.php
@@ -3126,10 +3126,11 @@ class Attribute extends AppModel {
 		if (isset($attribute['encrypt'])) {
 			$result = $this->handleMaliciousBase64($eventId, $attribute['value'], $attribute['data'], array('md5'));
 			$attribute['data'] = $result['data'];
 			$attribute['value'] = $attribute['value'] . '|' . $result['md5'];
 		}
+		unset($attribute['id']);
 		if (isset($attribute['uuid'])) {
 			$existingAttribute = $this->find('first', array(
 				'conditions' => array('Attribute.uuid' => $attribute['uuid']),
 				'recursive' => -1
 			));

Fixed code: 		unset($attribute['id']);