aswin1906/github-advisory-2022 huggingface dataset:
Overflow in `tf.keras.losses.poisson`
Advisory: GHSA-8fvv-46hw-vpg3
Aliases: CVE-2022-41887
Published: 2022-11-21T20:41:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
[`tf.keras.losses.poisson`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/keras/losses.py) receives a `y_pred` and `y_true` that are passed through `functor::mul` in [`BinaryOp`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/cwise_ops_common.h). If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size mismatch during broadcast assignment.
```python
import numpy as np
import tensorflow as tf

true_value = tf.reshape(shape=[1, 2500000000], tensor = tf.zeros(dtype=tf.bool, shape=[50000, 50000]))
pred_value = np.array([[[-2]], [[8]]], dtype = np.float64)

tf.keras.losses.poisson(y_true=true_value,y_pred=pred_value)
```

### Patches
We have patched the issue in GitHub commit [c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c](https://github.com/tensorflow/tensorflow/commit/c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1 and 2.9.3, as these are also affected and still in supported range. However, we will not cherrypick this commit into TensorFlow 2.8.x, as it depends on Eigen behavior that changed between 2.8 and 2.9.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattankul.
mm-wiki is vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-99g5-5643-xphp
Aliases: CVE-2021-40289
Published: 2022-11-10T19:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS).
Denial of service in Mattermost
Advisory: GHSA-v42f-hq78-8c5m
Aliases: CVE-2022-4045
Published: 2022-11-23T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data.
Apache Ivy vulnerable to path traversal
Advisory: GHSA-wv7w-rj2x-556x
Aliases: CVE-2022-37866
Published: 2022-11-07T19:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy versions 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.
Cross-site Scripting in librenms/librenms
Advisory: GHSA-5h77-4245-pg5p
Aliases: CVE-2022-3562
Published: 2022-11-20T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user
Advisory: GHSA-463w-hxfv-g9f6
Aliases: CVE-2022-40308
Published: 2022-11-15T19:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files. If anonymous read enabled, it's possible to read the database file directly without logging in.
Cross-site Scripting in Apache Hama
Advisory: GHSA-4wfh-48v4-3r84
Aliases: CVE-2022-45470
Published: 2022-11-21T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.
Package discontinued because Bitly lowered the free quota
Advisory: GHSA-ggrh-grj3-vfvw
Published: 2022-11-28T23:00:22Z

On November 17, 2022, an email was received from Bitly advising that the new link quota per free token is lowered to 50 per month (from its previous value of 1000 per month). As per the email, this change is effective on December 8, 2022.

The new quota is so low as to not be useful. For this reason, the maintenance of this package is being discontinued, although the package should continue to function with the limited new quota.
ManyDesigns Portofino subject to creation of insecure temporary file
Advisory: GHSA-925r-r6rp-2jj7
Aliases: CVE-2022-3952
Published: 2022-11-11T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

A vulnerability has been found in ManyDesigns Portofino 5.3.2. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component.
Failing DTLS handshakes may cause throttling to block processing of records
Advisory: GHSA-p72g-cgh9-ghjg
Aliases: CVE-2022-39368
Published: 2022-11-09T17:20:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

### Impact

Failing handshakes didn't cleanup counters for throttling. In consequence the threshold may get reached and will not be released again. The results in permanently dropping records. The issues was reported for certificate based handshakes, but it can't be excluded, that this happens also for PSK based handshakes. It generally affects client and server as well.

### Patches

main: commit 726bac57659410da463dcf404b3e79a7312ac0b9 
2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f

Users are requested to update to 3.7.0. If Californium 2 support is required, users are requested to update to 2.7.4. 

### Workarounds
none.
OpenCart SQL injection vulnerability
Advisory: GHSA-236j-rfx5-wq38
Aliases: CVE-2021-37823
Published: 2022-11-03T19:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.
Overflow in `ImageProjectiveTransformV2`
Advisory: GHSA-54pp-c6pp-7fpx
Aliases: CVE-2022-41886
Published: 2022-11-21T20:40:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
When [`tf.raw_ops.ImageProjectiveTransformV2`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/image_ops.cc) is given a large output shape, it overflows.
```python
import tensorflow as tf

interpolation = "BILINEAR"
fill_mode = "REFLECT"
images = tf.constant(0.184634328, shape=[2,5,8,3], dtype=tf.float32)
transforms = tf.constant(0.378575385, shape=[2,8], dtype=tf.float32)
output_shape = tf.constant([1879048192,1879048192], shape=[2], dtype=tf.int32)
tf.raw_ops.ImageProjectiveTransformV2(images=images, transforms=transforms, output_shape=output_shape, interpolation=interpolation, fill_mode=fill_mode)
```

### Patches
We have patched the issue in GitHub commit [8faa6ea692985dbe6ce10e1a3168e0bd60a723ba](https://github.com/tensorflow/tensorflow/commit/8faa6ea692985dbe6ce10e1a3168e0bd60a723ba).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou from the Secure Systems Lab (SSL) at Brown University.
HashiCorp Nomad vulnerable to Insufficient Session Expiration
Advisory: GHSA-9fmc-5fq4-5jwh
Aliases: CVE-2022-3867
Published: 2022-11-10T12:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.
Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
Advisory: GHSA-93vw-8fm5-p2jf
Aliases: CVE-2022-41879
Published: 2022-11-10T13:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact

A compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option.

### Patches

Improved keyword detection.

### Workarounds

None.

### Collaborators

Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf
qs vulnerable to Prototype Pollution
Advisory: GHSA-hrpp-h998-j3pp
Aliases: CVE-2022-24999
Published: 2022-11-27T00:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
Apache Sling App CMS vulnerable to Cross-site Scripting
Advisory: GHSA-jj93-4jr5-x45h
Aliases: CVE-2022-43670
Published: 2022-11-02T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A Cross-site Scripting vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
ezplatform-graphql GraphQL queries can expose password hashes
Advisory: GHSA-c7pc-pgf6-mfh5
Aliases: CVE-2022-41876
Published: 2022-11-10T21:46:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors.

### Patches

Resolving versions: Ibexa DXP v1.0.13, v2.3.12

### Workarounds
Remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.

### References

This issue was reported to us by Philippe Tranca ("trancap") of the company Lexfo. We are very grateful for their research, and responsible disclosure to us of this critical vulnerability. 

### For more information
If you have any questions or comments about this advisory, please contact Support via your service portal.
Creation of new database tables through login form on PostgreSQL
Advisory: GHSA-4x5r-6v26-7j4v
Aliases: CVE-2022-41932
Published: 2022-11-21T22:36:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form.

### Patches

The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2.

### Workarounds

The only workarounds for this are:
* use an authenticator which does interpret the login as a reference to a document
* using a different database than PostgreSQL
* upgrade XWiki

### References

https://jira.xwiki.org/browse/XWIKI-19886

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Withdrawn: Octocat.js vulnerable to code injection
Advisory: GHSA-r4jg-5v89-9v62
Aliases: CVE-2022-39390
Published: 2022-11-08T20:48:49Z
Withdrawn: 2022-11-09T22:35:46Z

## Withdrawn

This advisory has been withdrawn because it is a test.

## Original Description

### Impact
Users can include their own images for accessories via provided URLs. These URLs are not validated and can result in execution of injected code.

### Patches
This vulnerability was fixed in version 1.2 of octocat.js

### Workarounds
Directly exposing rendered images to a website can introduce the vulnerability to users. To avoid, writing an image to disk then using that image in an image element in HTML mitigates the risk.

### References
To render the file correctly, see documentation at `readme.md`

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the octo.js repository](http://github.com/octocademy/octocat.js/issues)
Tailscale daemon is vulnerable to information disclosure via CSRF
Advisory: GHSA-qccm-wmcq-pwr6
Aliases: CVE-2022-41925
Published: 2022-11-21T22:34:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables.

**Affected platforms:** All
**Patched Tailscale client versions:** v1.32.3 or later, v1.33.257 or later (unstable)

### What happened?
In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables.

### Who is affected?
All Tailscale clients prior to version v.1.32.3 are affected.

### What should I do?
Upgrade to v1.32.3 or later to remediate the issue.

### What is the impact?
An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop.

An attacker with access to the peer API who sent a malicious file via Taildrop which was accessed while it was loading could use this to gain access to the local API, and remotely execute code.

There is no evidence of this vulnerability being purposefully triggered or exploited.

### Credits
We would like to thank [Emily Trau](https://github.com/emilytrau) and [Jamie McClymont (CyberCX)](https://twitter.com/JJJollyjim) for reporting this issue. Further detail is available in [their blog post](https://emily.id.au/tailscale).

### References
* [TS-2022-005](https://tailscale.com/security-bulletins/#ts-2022-005)
* [Researcher blog post](https://emily.id.au/tailscale)

### For more information
If you have any questions or comments about this advisory, [contact Tailscale support](https://tailscale.com/contact/support/).
Tauri Filesystem Scope can be Partially Bypassed
Advisory: GHSA-q9wv-22m9-vhqh
Aliases: CVE-2022-41874
Published: 2022-11-08T17:33:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

### Impact

Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it was possible to partially bypass the `fs` scope definition. It was not possible to traverse into arbitrary paths, as the issue was limited to neighboring files and sub folders of already allowed paths.

The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters.

On Linux or MacOS based systems it was possible to use the `*`, `**` and `[a-Z]` patterns inside a path, which allowed to read the content of sub directories and single character files in a folder, where only specific files or the directory itself were allowed.

On Windows `[a-Z]` was the possible bypass pattern, as `*` is not treated as a valid path component. This implies that only single character files inside an already allowed directory were unintentionally accessible.

This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime.

A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. This means the issue by itself can not be abused and requires further intentional or unintentional privileges.

### Workaround

Disable the `dialog` and `fileDropEnabled` component inside the `tauri.conf.json`.

### Patches

The issue has been resolved in #5237 and the implementation now properly escapes the special characters. The patch has been included in releases: `1.0.7`, `1.1.2` and `1.2.0`

### For more information

This issue was initially reported by MessyComposer in #5234.

If you have any questions or comments about this advisory:

Open an issue in tauri
Email us at security@tauri.app
ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
Advisory: GHSA-9mfc-chwf-7whf
Published: 2022-11-02T18:14:01Z

### Impact

When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. 

### Patches

In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.

In 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.
FeehiCMS is vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-3ppm-fwhm-qqg6
Aliases: CVE-2022-43320
Published: 2022-11-09T19:02:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.
Missing permissions check in Liferay Portal
Advisory: GHSA-642h-mx8q-47p2
Aliases: CVE-2022-42126
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.
Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin
Advisory: GHSA-x2w2-5552-fjv6
Aliases: CVE-2022-45392
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These passwords can be viewed by attackers with Item/Extended Read permission or access to the Jenkins controller file system.

NS-ND Integration Performance Publisher Plugin 4.8.0.146 stores passwords encrypted once job configurations are saved again.
Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
Advisory: GHSA-mq7h-5574-hw9f
Aliases: CVE-2022-41927
Published: 2022-11-21T22:34:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

### Impact

It's possible with a simple request to perform deletion or renaming of tags without needing any confirmation, by using a CSRF attack. 

### Patches

The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. 

### Workarounds

It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting:
```
#if (!$services.csrf.isTokenValid($request.get('form_token')))
    #set ($discard = $response.sendError(401, "Wrong CSRF token"))
#end
```

See the commit with the fix for more information about patching the page: https://github.com/xwiki/xwiki-platform/commit/7fd4cda0590180c4d34f557597e9e10e263def9e

### References

  * https://jira.xwiki.org/browse/XWIKI-19748
  * https://github.com/xwiki/xwiki-platform/commit/7fd4cda0590180c4d34f557597e9e10e263def9e

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Ibexa DXP users with the Company admin role can assign any role to any user
Advisory: GHSA-g6jc-xrc3-4wwq
Published: 2022-11-10T23:56:13Z

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString
Advisory: GHSA-4j2x-v3mr-467m
Aliases: CVE-2022-45207
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.
Missing Authorization in Filter Stream Converter Application of XWiki-platform
Advisory: GHSA-q6jp-gcww-8v2j
Aliases: CVE-2022-41937
Published: 2022-11-21T23:46:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

### Impact

The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package.

### Patches

The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8.

### Workarounds

The problem can be patched immediately by setting the right of the page Filter.WebHome and making sure only main wiki administrators can VIEW it the application is installed on main wiki or edit the page and apply the changed described on  https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113.

### References

* https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113
* https://jira.xwiki.org/browse/XWIKI-19758

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability 
Advisory: GHSA-395x-wv32-44v5
Aliases: CVE-2022-39325
Published: 2022-11-28T22:14:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

There is a cross-site scripting vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

### Target
baserCMS 4.7.1 and earlier versions.

### Vulnerability
Execution of malicious JavaScript code may alter the display of the page or leak cookie information.
- In Favorite registration (CVE-2022-39325)
- In Permission Settings (CVE-2022-41994)
- In User group management (CVE-2022-42486)

### Countermeasures
Update to the latest version of baserCMS

### Credits
- Shogo Iyota@Mitsui Bussan Secure Directions, Inc.
- YUYA KOTAKE@CARTA HOLDINGS, INC.
sweetalert2 v9.17.4 and above contains hidden functionality
Advisory: GHSA-pg98-6v7f-2xfv
Published: 2022-11-23T15:44:52Z

`sweetalert2` versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 9.0.0 - 9.17.3.

### Workaround
Use a version 9.0.0 - 9.17.3 of the package until the maintainer releases a fix.
Jeecg-boot vulnerable to SQL Injection
Advisory: GHSA-v87q-rpwp-qr7q
Aliases: CVE-2022-45210
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.
fastify/websocket vulnerable to uncaught exception via crash on malformed packet
Advisory: GHSA-4pcg-wr6c-h9cq
Aliases: CVE-2022-39386
Published: 2022-11-07T21:13:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

Any application using @fastify/websocket could crash if a specific, malformed packet is sent. 

All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched.

### Patches

This has been patched in v7.1.1 (fastify v4) and v5.0.1 (fastify v3).

### Workarounds

No known workaround is available. However, it should be possible to attach the error handler manually.
The recommended path is upgrading to the patched versions.

## Credits

[marcolanaro](https://github.com/marcolanaro) for finding and patching this vulnerability

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [@fastify/websocket](https://github.com/fastify/fastify-websocket)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information
Advisory: GHSA-q3hq-hm5h-qrx3
Aliases: CVE-2022-43691
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production.
Remote code execution via MongoDB BSON parser through prototype pollution
Advisory: GHSA-prm5-8g2m-24gg
Aliases: CVE-2022-39396
Published: 2022-11-08T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. 

### Patches

Prevent prototype pollution in MongoDB database adapter.

### Workarounds

Disable remote code execution through the MongoDB BSON parser.

### Collaborators

Mikhail Shcherbakov (KTH), Cristian-Alexandru Staicu (CISPA) and Musard Balliu (KTH) working with Trend Micro Zero Day Initiative

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg
Overflow in `FusedResizeAndPadConv2D`
Advisory: GHSA-762h-vpvw-3rcx
Aliases: CVE-2022-41885
Published: 2022-11-21T20:40:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
When [`tf.raw_ops.FusedResizeAndPadConv2D`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc) is given a large tensor shape, it overflows.
```python
import tensorflow as tf

mode = "REFLECT"
strides = [1, 1, 1, 1]
padding = "SAME"
resize_align_corners = False
input = tf.constant(147, shape=[3,3,1,1], dtype=tf.float16)
size = tf.constant([1879048192,1879048192], shape=[2], dtype=tf.int32)
paddings = tf.constant([3,4], shape=[2], dtype=tf.int32)
filter = tf.constant(123, shape=[1,3,4,1], dtype=tf.float16)
tf.raw_ops.FusedResizeAndPadConv2D(input=input, size=size, paddings=paddings, filter=filter, mode=mode, strides=strides, padding=padding, resize_align_corners=resize_align_corners)
```

### Patches
We have patched the issue in GitHub commit [d66e1d568275e6a2947de97dca7a102a211e01ce](https://github.com/tensorflow/tensorflow/commit/d66e1d568275e6a2947de97dca7a102a211e01ce).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou from the Secure Systems Lab (SSL) at Brown University.
Subrion CMS is vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-3wmg-28v9-8hf6
Aliases: CVE-2022-43120
Published: 2022-11-09T19:02:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS version 4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.
Cross-site Scripting in Zenario
Advisory: GHSA-f454-jm6x-56q6
Aliases: CVE-2022-44070
Published: 2022-11-16T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.
Pillow vulnerable to Data Amplification attack.
Advisory: GHSA-m2vv-5vj5-2hm7
Aliases: CVE-2022-45198
Published: 2022-11-14T12:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
Sinatra vulnerable to Reflected File Download attack
Advisory: GHSA-2x8x-jmrp-phxw
Aliases: CVE-2022-45442
Published: 2022-11-30T21:18:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Description
An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

### References
* https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
* https://github.com/advisories/GHSA-8x94-hmjh-97hq
deep-object-diff vulnerable to Prototype Pollution
Advisory: GHSA-653v-rqx9-j85p
Aliases: CVE-2022-41713
Published: 2022-11-04T12:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited. This issue was fixed in version 1.1.9.
`CHECK` failure in `SobolSample` via missing validation
Advisory: GHSA-cqvq-fvhr-v6hc
Published: 2022-11-21T23:51:53Z

### Impact
Another instance of CVE-2022-35935, where `SobolSample` is vulnerable to a denial of service via assumed scalar inputs, was found and fixed.
```python
import tensorflow as tf
tf.raw_ops.SobolSample(dim=tf.constant([1,0]), num_results=tf.constant([1]), skip=tf.constant([1]))
```

### Patches
We have patched the issue in GitHub commits [c65c67f88ad770662e8f191269a907bf2b94b1bf](https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf) and [02400ea266bd811fc016a848445de1bbff3a23a0](https://github.com/tensorflow/tensorflow/commit/02400ea266bd811fc016a848445de1bbff3a23a0)

The fix will be included in TensorFlow 2.11. We will also cherrypick both commits on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. TensorFlow 2.7.4 will have the first commit cherrypicked.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by:
- Kang Hong Jin from Singapore Management University
- Neophytos Christou, Secure Systems Labs, Brown University
- 刘力源, Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology
- Pattarakrit Rattankul
Apache Dolphin Scheduler has insufficiently protected credentials 
Advisory: GHSA-jvc3-wjf6-7c6c
Aliases: CVE-2022-26885
Published: 2022-11-24T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.
Leak in Aliyun  KeySecret 
Advisory: GHSA-3w3h-7xgx-grwc
Aliases: CVE-2022-39397
Published: 2022-11-21T20:39:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

### Impact
Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally.

### Patches
This have already been solved.

### Workarounds
No, It cannot be patched without upgrading

### References
No

### For more information
If you have any questions or comments about this advisory:
* Email us at [email address](mailto:772364230@qq.com)
Password exposure in H2 Database 
Advisory: GHSA-22wj-vf5f-wrvj
Aliases: CVE-2022-45868
Published: 2022-11-23T21:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that."
Temporary File Information Disclosure vulnerability in MPXJ
Advisory: GHSA-jf2p-4gqj-849g
Aliases: CVE-2022-41954
Published: 2022-11-28T22:09:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

### Impact
On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a type of schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ.

### Patches
The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes.

### Workarounds
Setting `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

### For more information
If you have any questions or comments about this advisory
* Open an issue in https://github.com/joniles/mpxj
Silverstipe CMS Stored XSS in custom meta tags
Advisory: GHSA-pp74-g2q5-j4jf
Aliases: CVE-2022-37421
Published: 2022-11-21T23:59:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A malicious content author could create a custom meta tag and execute an arbitrary JavaScript payload. This would require convincing a legitimate user to access a page and enter a custom keyboard shortcut.
This requires CMS access to exploit.
Cross-site Scripting in librenms/librenms
Advisory: GHSA-p55m-g4m3-qmrp
Aliases: CVE-2022-4069
Published: 2022-11-20T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
PaddlePaddle vulnerable to code injection via winstr
Advisory: GHSA-83g7-8fch-p37m
Aliases: CVE-2022-45908
Published: 2022-11-26T03:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.
Cross-site Scripting in librenms/librenms
Advisory: GHSA-f3hw-3h74-wr98
Aliases: CVE-2022-4068
Published: 2022-11-20T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
owncast is vulnerable to SQL Injection
Advisory: GHSA-cvh4-cjc9-84qm
Aliases: CVE-2022-3751
Published: 2022-11-29T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
Read the Docs vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-98pf-gfh3-x3mp
Published: 2022-11-10T16:02:51Z

### Impact

This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project. 

Exploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like `hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/`.

### Patches

This issue has been patched in our 8.8.1 release.
Apache UIMA Path Traversal vulnerability
Advisory: GHSA-xgqr-5wqw-9fpv
Aliases: CVE-2022-32287
Published: 2022-11-03T19:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior versions. Note that PEAR files should never be installed into an UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine.
Witness Block Parsing DoS Vulnerability 
Advisory: GHSA-hc82-w9v8-83pr
Aliases: CVE-2022-39389
Published: 2022-11-18T18:50:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

### Impact

All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. 

This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. 

### Patches

A patch is available starting with lnd `v0.15.4`. 

### Workarounds

Nodes can use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present. 

### References

https://github.com/lightningnetwork/lnd/issues/7096

https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta
`CHECK` fail in `BCast` overflow
Advisory: GHSA-h246-cgh4-7475
Aliases: CVE-2022-41890
Published: 2022-11-21T20:42:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`BCast::ToShape`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in [`tf.experimental.numpy.outer`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) by passing in large input to the input `b`.
```python
import tensorflow as tf
value = tf.constant(shape=[2, 1024, 1024, 1024], value=False)
tf.experimental.numpy.outer(a=6,b=value)
```

### Patches
We have patched the issue in GitHub commit [8310bf8dd188ff780e7fc53245058215a05bdbe5](https://github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc53245058215a05bdbe5).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattankul.
Arbitrary file read vulnerability in Jenkins Pipeline Utility Steps Plugin
Advisory: GHSA-3g9q-cmgv-g4p6
Aliases: CVE-2022-45381
Published: 2022-11-16T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Pipeline Utility Steps Plugin implements a `readProperties` Pipeline step that supports interpolation of variables using the Apache Commons Configuration library.

Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the `file:` prefix interpolator by default.

This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to `base64Decoder:`, `base64Encoder:`, `date:`, `urlDecoder:`, and `urlEncoder:`.

Administrators can set the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPS` to customize which prefix interpolators are enabled.
btcd mishandles witness size checking
Advisory: GHSA-2chg-86hq-7w38
Aliases: CVE-2022-44797
Published: 2022-11-07T12:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
ckb type_id script resume may randomly fail
Advisory: GHSA-mcmr-49x3-4jqm
Published: 2022-11-02T18:15:07Z

### Impact
https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879
TypeIdSystemScript resume handle is not correct when max_cycles is not enough, `ScriptError::ExceededMaximumCycles` will be raised directly ranther than suspend as expect, and also because script_group execution order is random, so this will happen randomly.
sweetalert2 v11.4.9 and above contains hidden functionality
Advisory: GHSA-qq6h-5g6j-q3cm
Published: 2022-11-23T15:26:43Z

`sweetalert2` versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 11.0.0 - 11.4.8.

### Workaround
Use a version 11.0.0 - 11.4.8 of the package until the maintainer releases a fix.
Cross-site Scripting in Zenario
Advisory: GHSA-r9xx-4cmv-856x
Aliases: CVE-2022-44069
Published: 2022-11-16T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.
Snakeyaml vulnerable to Stack overflow leading to denial of service
Advisory: GHSA-w37g-rhq8-7m4j
Aliases: CVE-2022-41854
Published: 2022-11-11T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
Authorization Bypass in Liferay Portal
Advisory: GHSA-g6x4-57hp-j4xm
Aliases: CVE-2022-42129
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
Redwood is vulnerable to account takeover via dbAuth "forgot-password" 
Advisory: GHSA-3qmc-2r76-4rqp
Published: 2022-11-10T15:51:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

# Impact

_What kind of vulnerability is it? Who is impacted?_

This is an API vulnerability in Redwood's [dbAuth], specifically the dbAuth forgot password feature:
- only projects with the dbAuth "forgot password" feature are affected
- this vulnerability was introduced in v0.38.0

## User Accounts are Vulnerable to Takeover (Hijacking)

A reset token for any user can be obtained given knowledge of their username or email via the forgot-password API. With the leaked reset token, a malicious user could request to reset a user's password, changing their credentials and gaining access to their account.

## How to Determine if Projects have been Attacked

To determine if a project has been attacked, we recommend checking logs for suspicious activity; namely, the volume of requests to the forgot-password API using emails that don't exist. Another indication is if users inform you that they can't access their accounts.

If you have question or concerns, reach out via the "For More Information" section below.

# Patch Releases Available

**The problem has been patched on the v3 and v2 release lines.** Users should upgrade to **v3.3.1+**  or **v2.2.5+** respectively.

## Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

We recommend upgrading to the Patch Releases above. If upgrading is not possible, there are several workarounds:

### Manually strip out `resetToken` and `resetTokenExpiresAt` in the `forgotPassword.handler()`

Users on all release lines can have their `forgotPassword.handler()` function strip out the sensitive fields manually before returning

```js
handler: (user) => {
  // your code to notify/email user of the link to reset their password...

  const = { resetToken, resetTokenExpiresAt, ...rest }

  return rest
}
```

### Use `yarn patch` to manually apply the fix

Users on v3 and v2 can use [`yarn patch`] to apply the fix if they're using yarn v3. See the dbAuth "forgot-password" Account Takeover Vulnerability high gist for instructions. 

### Disable the forgot password flow entirely v3 only

Users on v3 can disable the forgot password flow entirely.